Subject: [lisp] Call for interest in working on security

From: Sam Hartman <[email-masked]>
Date: Mon, 21 Sep 2009 07:10:34 -0400

Speaking as an individual.  There's a bit with my chair hat on at the
end clearly labeled.

So, I'd like to see some progress on discussing security here.  I've
started an outline of what I think we need to cover at
http://tools.ietf.org/wg/lisp/trac/wiki/Security01 .  The idea is that
people who agree with the direction I'm taking can join and we can
work together putting together something in the open that we'll bring
to the WG for review when it's ready.  I want to do everything in the
open so people know what I'm up to, and so people who have other ideas
are encouraged to actually go write up their ideas.  However at this
point I'm not trying to build a WG-wide consensus.

I've started with a broad outline and a set of reading material.  If
the outline and my posited goals for LISP security sounds interesting
to you, then perhaps you want to become involved.  If so, then I'd
recommend starting by reading some or all of the recommended reading.
Hopefully some people around here have already read several of the
things there.

There's probably not enough detail for you to agree with the direction
enough to join the proposal at this point.  However I'm definitely
interested in comments even at this stage, especially about things to
add to the reading list, or headings I missed.

I hope we can get things kick-started.

Speaking as a chair, If anyone wants wiki space for this sort of
thing, by all means take it.  If you run into authorization problems
or anything else, let the chairs know.  I ask that you make your page
clearly labeled as an individual/group proposal but not as a WG
effort.  Also, it looks tricky to rename pages.  So, please don't take
a page name we're likely to want to use.

If people think using the WG wiki for this sort of pre-WG effort is a
bad idea, then let me know; I can find hosting elsewhere.  I was just
trying to be open.

---

From: Eliot Lear <[email-masked]>
Date: Wed, 23 Sep 2009 07:48:46 +0200

Sam,

I read through your wiki discussion and I think it's pretty good as far
as it goes.  There are a number of questions that I think you allude to
that perhaps you should ask explicitly:

   1. How does breaking into an ALT router differ from breaking into a
      BGP router within the DFZ?
      To me this really depends on how the ALT is constructed.  If it is
      constructed in a highly aggregated way, as envisioned, then the
      ability to reroute traffic is limited to only those networks,
      combined with the BGP metric.  The DFZ only has the BGP metric and
      perhaps some ACLs in some places to fall back on.
   2. Can ALT take advantage of SIDR?
      Here I am not so much an expert on SIDR to say.

I will make the following two general assertions, as relates to your
comment about key management:

    * the problem is operationally difficult when there are large
      numbers of signers and/or long trust chains.
    * a small number of signers requires concentration of trust far
      beyond the point of what exists today (perhaps by 3 orders of
      magnitude or more), leading to potential continuity problems.

These were the trade-offs I explored with NERD.

Regards,

Eliot

On 9/21/09 1:10 PM, Sam Hartman wrote:
> _______________________________________________
> lisp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lisp
>
>

---

From: Sam Hartman <[email-masked]>
Date: Wed, 23 Sep 2009 06:40:18 -0400

I really appreciate your thoughtful comments.

I'll admit that I am personally interested in the non-alt parts of
LISP security.  My perhaps naive assumption is that something like
SIDR can be applied and that I'd like to get a better handle on the
surrounding landscape before I think in detail about that.

However thinking about how the alt differed from traditional
BGP--particularly in terms of the implications of high aggrigation on
security--is something I had not done.

One other comment:
>>>>> "Eliot" == Eliot Lear <[email-masked]> writes:
    Eliot> I will make the following two general assertions, as relates to your comment
    Eliot> about key management:

    Eliot>   â¢ the problem is operationally difficult when there are large numbers of
    Eliot>     signers and/or long trust chains.
    Eliot>   â¢ a small number of signers requires concentration of trust far beyond the
    Eliot>     point of what exists today (perhaps by 3 orders of magnitude or more),
    Eliot>     leading to potential continuity problems.

    Eliot> These were the trade-offs I explored with NERD.

These are interesting.  However I don't think I have talked about key
management for anything involving signers at all so far.  I've talked
about key management for map register, but there explicitly talked
about a solution with no public key ops.

---

From: Luigi Iannone <[email-masked]>
Date: Sat, 26 Sep 2009 13:21:55 +0200

Hi Sam,

Upon request on the WG chairs a couple of IETFs ago we already started  
to work on security (see attachment).
Roque Gagliano also was interested in contributing to the attached  
draft.

The idea of the draft was to try to list all possible threats of the  
loc/ID split paradigm,  and then look how the LISP architecture deals  
with each of them, pointing out if LISP is sufficiently secure, or if  
some work has to be done on some specific cases.

Seems that you are not happy with the advances since you started  
something completely new on the security topic.

Get a look to the draft and let me know if you find something useful  
or you think we can merge the efforts.

Coming back to you page, I really think that we should analyze the  
mapping system from the inside. What I mean is that we do not need to  
analyze the ALT, or whatever mapping system you like, the most  
appropriate approach is IMO to give a set "guidelines/requirements" (I  
do not have a better word right now) for designing a mapping system.

Discussing if ALT provides the same level of security like BGP is IMHO  
a waste of time.

What level of security a   mapping system has to guarantee/provide/ 
comply with?
This is the kind of question we should answer.

Then in the spec of each mapping system should be described how the  
proposal fulfills the requirements of the security doc.

Ciao

  Luigi

On Sep 23, 2009, at 12:40 , Sam Hartman wrote:

>    Eliot>   • the problem is operationally difficult when there  
> are large numbers of
>    Eliot>   • a small number of signers requires concentration of  
> trust far beyond the

---

From: Eliot Lear <[email-masked]>
Date: Sat, 26 Sep 2009 16:26:15 +0200

Luigi,

> What level of security a   mapping system has to
> guarantee/provide/comply with?

I think both questions are valid.  We need to answer the former before
letting something loose out on the network.  In order to do that there
needs to be some comparison.  That having been said, I would imagine
that the comparison is made easier by answering your 2nd question,
because quite frankly it has GOT to be possible to do better than what
is out there today.  The question I've always hit against is whether you
can do so in a way that doesn't concentrate operational risk into a few
components, something that is somewhat antithetical to most L3 dogma.

Eliot

---

From: Luigi Iannone <[email-masked]>
Date: Sat, 26 Sep 2009 20:16:06 +0200

Eliot,

I agree with you, let me just add a clarification

>> Discussing if ALT provides the same level of security like BGP is  

My point here was that the security of ALT should be discussed in the  
ALT spec, not in the general security document.
If we start talking about ALT in the general security framework we  
will focus on ALT and will miss the bigger picture.

Luigi

---

From: Eliot Lear <[email-masked]>
Date: Sun, 27 Sep 2009 12:44:23 +0200

Luigi,

You're right that we should be careful about separating the systems.  I
like, by the way, both your and Sam's organizing principles.

Eliot