Subject: Re: [lisp] Kathleen Moriarty's Discuss on draft-ietf-lisp-introduction-12: (with DISCUSS and COMMENT)

From: "Joel M. Halpern" <[email-masked]>
Date: Thu, 05 Mar 2015 05:37:52 -0500

I am not sure what would go in the introduction document that would 
address Radia's concern.

Each mapping system document includes security considerations that are 
specific to that mapping system.  The Original BGP based system has one 
set of properties, the DDT one (which we will be advancing after the 
blocking documents are cleared) as a different set.  The introduction 
document is not a requirements document driving that work, but rather an 
explanation.
I suppose we could add a short paragraph that notes that individual 
mapping systems need to address traffic misdirection threats, and that 
the mapping system interfaces (Map Servers and Map Resolvers, and the 
protocol between ITRs/ETRs and those components) need to address a 
multitude of security issues.  But would that kind of text really help 
the introduction?

I very much don't want to see this document getting into the question of 
why not to use DNS as the mapping system, or a DNS clone, or ...  One of 
the keys to the LISP design is that different mapping system designs can 
be and are being tried.  One of the challenges in writing this 
introduction is to reflect the existing RFCs while allowing for the new 
work such as DDT that we know the working group plans so as not to 
obsolete this introduction.

Yours,
Joel

On 3/4/15 9:11 PM, Kathleen Moriarty wrote:
> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-lisp-introduction-12: Discuss
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-lisp-introduction/
>
>
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
> It appears the SecDir review didn't make it to LISP list for some reason.
>   There is one important security request from Radia's review and many
> other good suggestions.
>
> https://www.ietf.org/mail-archive/web/secdir/current/msg05415.html
>
> Expanding the Security Considerations section would be helpful, here is
> the background on the request:
>
> There is a security considerations section, which focuses on a class of
> denial of service attacks. There are presumably security considerations
> sections in the other documents, including one that focuses entirely on
> security, so it is not necessary that all security issues be brought up
> here. That said, I think that if you were to write an "introduction to
> security considerations", there are more important ones than the DoS
> threat.
> in particular, as a routing protocol care must be taken to make sure a
> bad
> actor cannot attract someone else's traffic with mechanisms like those
> we
> are trying to address with BGP security. Much of the routing information
> is
> maintained in a database "like DNS". If it *were* DNS, DNSSEC could be
> used
> to address the integrity issues. If it is home grown, some equivalent
> mechanism will be necessary.  Why not use DNS?
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Please do look at the other suggestions from the review as they should
> help clarify a few points in the draft and provide the background needed
> for an introduction draft.
> https://www.ietf.org/mail-archive/web/secdir/current/msg05415.html
>
>
>

---

From: "Joel M. Halpern" <[email-masked]>
Date: Thu, 05 Mar 2015 05:37:52 -0500

Yours,
Joel

---

From: Brian Haberman <[email-masked]>
Date: Thu, 05 Mar 2015 08:15:41 -0500

Hi Joel,

> document is not a requirements document driving that work, but rather an

Agreed.

> multitude of security issues.  But would that kind of text really help

I think it would help by letting readers know that there are different
security considerations for the different types of mapping systems.

> obsolete this introduction.

I agree that this is not the document to get into the "use vs. not use"
the DNS for mapping.

Regards,
Brian

---

From: Brian Haberman <[email-masked]>
Date: Thu, 05 Mar 2015 08:15:41 -0500

Hi Joel,

Agreed.

Regards,
Brian

---

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 04 Mar 2015 18:11:02 -0800

---

From: Dino Farinacci <[email-masked]>
Date: Thu, 5 Mar 2015 08:27:46 -0800

> On Mar 4, 2015, at 6:11 PM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Much of the routing information
> is

Because you create a circular dependency. Routing should not depend on directory at the same time directory depends on routing. 

See LISP-DDT-SEC for mapping database security. 

Dino

---

From: Dino Farinacci <[email-masked]>
Date: Thu, 5 Mar 2015 08:27:46 -0800

Dino

---

From: Eliot Lear <[email-masked]>
Date: Thu, 05 Mar 2015 19:08:42 +0100

Hi Dino,

> Because you create a circular dependency. Routing should not depend on directory at the same time directory depends on routing. 

I mostly agree with this point.  It is possible to engineer a network
such that this doesn't happen, but that increases the
effort/planning/management required to successfully manage the system as
a whole.
> See LISP-DDT-SEC for mapping database security. 

Yes.

---

From: Eliot Lear <[email-masked]>
Date: Thu, 05 Mar 2015 19:08:42 +0100

Hi Dino,

Yes.