From joelja@bogus.com Mon Jan 4 21:31:55 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4AEAE3A67B0 for ; Mon, 4 Jan 2010 21:31:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UnC5osxf6iKI for ; Mon, 4 Jan 2010 21:31:54 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id 8F6D43A6782 for ; Mon, 4 Jan 2010 21:31:54 -0800 (PST) Received: from [192.168.1.151] (c-98-234-104-156.hsd1.ca.comcast.net [98.234.104.156]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o055V7Md066436 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 5 Jan 2010 05:31:51 GMT (envelope-from joelja@bogus.com) Message-ID: <4B42CE9B.8070505@bogus.com> Date: Mon, 04 Jan 2010 21:31:07 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: "'opsec@ietf.org'" , ddugal@juniper.net, cpignata@cisco.com, rodunn@cisco.com X-Enigmail-Version: 0.96.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Tue, 05 Jan 2010 05:31:51 +0000 (UTC) Subject: [OPSEC] noted: draft-dugal-opsec-protect-control-plane-00 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jan 2010 05:31:55 -0000 I notes with interest today the initial publication of: http://tools.ietf.org/html/draft-dugal-opsec-protect-control-plane-00 for which I am certain review and feedback would be greatly appreciated. thanks joel From joelja@bogus.com Mon Jan 4 21:36:58 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 581A73A6808 for ; Mon, 4 Jan 2010 21:36:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qCP7ZsX+zag9 for ; Mon, 4 Jan 2010 21:36:56 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id D55023A67B0 for ; Mon, 4 Jan 2010 21:36:56 -0800 (PST) Received: from [192.168.1.151] (c-98-234-104-156.hsd1.ca.comcast.net [98.234.104.156]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o055aCCf066708 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 5 Jan 2010 05:36:55 GMT (envelope-from joelja@bogus.com) Message-ID: <4B42CFCC.3030501@bogus.com> Date: Mon, 04 Jan 2010 21:36:12 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: "'opsec@ietf.org'" References: <4B29DEE9.1090202@bogus.com> In-Reply-To: <4B29DEE9.1090202@bogus.com> X-Enigmail-Version: 0.96.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Tue, 05 Jan 2010 05:36:55 +0000 (UTC) Subject: Re: [OPSEC] (deadline for last call is 1/7/10) Working Group last call for draft-ietf-opsec-routing-protocols-crypto-issues-02 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jan 2010 05:36:59 -0000 Just as a reminder there remain three days to submitt comments before the last call window closes. Thanks joel Joel Jaeggli wrote: > This is the working group Last call for > draft-ietf-opsec-routing-protocols-crypto-issues-02 > > Please review the current draft: > > http://tools.ietf.org/html/draft-ietf-opsec-routing-protocols-crypto-issues-02 > > Deadline for Comments is 0000 UTC, Thurs Jan 7th 2010. the extended > period is to account for the compound set of holidays occuring in a > number of locations within the immediate two week period. > > As per the minutes the thinking is that this draft will be aimed at > informational status. > > thanks > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > From glen.kent@gmail.com Wed Jan 6 10:23:43 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1A8E428C103 for ; Wed, 6 Jan 2010 10:23:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D16mXELU9PN7 for ; Wed, 6 Jan 2010 10:23:42 -0800 (PST) Received: from mail-yx0-f174.google.com (mail-yx0-f174.google.com [209.85.210.174]) by core3.amsl.com (Postfix) with ESMTP id 1E25F3A693F for ; Wed, 6 Jan 2010 10:23:42 -0800 (PST) Received: by yxe4 with SMTP id 4so15949700yxe.32 for ; Wed, 06 Jan 2010 10:23:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=Zy1wJirCrfl87YvXGLfAWNVDVwJsn26/fHiRpkPymF8=; b=uicwZPDj0I8rT7bvgFnTZXSBV+5Ul7U+7s7wUUMjjKf7uy8RQ71z+b4NOumXtifzSO O5Pr8ZJKN7QcCTK6u01yJ2ceSrmmqixxIluK3w7keWhqVKGmnc1H750xFeay+bAavcKb o0+DLnCN7knoQN0s3sGVtUl+E+UxfgngIwpCc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=GaLKobCxKB4bS9bEftBvEBkNn3IFWH0nXHQ/nEdltEhdAjgktZaICpDJTf6m3Y0zEH 9TX/bKjw0xUsiR55SsK9iqWv1d/JLNrKDt6sGkaSOdp6l5+tWJXHvTr9FD3GFNcGpKko p2aMcul8RbFKnMMT56sB0UlcH3z7QUyw0W0l4= MIME-Version: 1.0 Received: by 10.101.190.1 with SMTP id s1mr9746701anp.94.1262802217222; Wed, 06 Jan 2010 10:23:37 -0800 (PST) In-Reply-To: <4B42CE9B.8070505@bogus.com> References: <4B42CE9B.8070505@bogus.com> Date: Wed, 6 Jan 2010 23:53:35 +0530 Message-ID: <92c950311001061023i39dd830eqd4fe2568f7106400@mail.gmail.com> From: Glen Kent To: Joel Jaeggli Content-Type: text/plain; charset=ISO-8859-1 Cc: cpignata@cisco.com, "opsec@ietf.org" Subject: Re: [OPSEC] noted: draft-dugal-opsec-protect-control-plane-00 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jan 2010 18:23:43 -0000 I read the draft and i am not sure i understand the motivation of why this needs to get published as an IETF standard. Am i missing something here? Glen On Tue, Jan 5, 2010 at 11:01 AM, Joel Jaeggli wrote: > I notes with interest today the initial publication of: > > http://tools.ietf.org/html/draft-dugal-opsec-protect-control-plane-00 > > for which I am certain review and feedback would be greatly appreciated. > > thanks > > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > From glen.kent@gmail.com Wed Jan 6 10:34:36 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 989733A692E for ; Wed, 6 Jan 2010 10:34:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZLJS-UUzmPnx for ; Wed, 6 Jan 2010 10:34:35 -0800 (PST) Received: from mail-yx0-f174.google.com (mail-yx0-f174.google.com [209.85.210.174]) by core3.amsl.com (Postfix) with ESMTP id 814DB3A6805 for ; Wed, 6 Jan 2010 10:34:35 -0800 (PST) Received: by yxe4 with SMTP id 4so15961054yxe.32 for ; Wed, 06 Jan 2010 10:34:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=BGM3u9puXvxhhhionLaijkO74PxXrfcbz9jpKydujlk=; b=GLKt73TALDBTUUANRrPvL0ZiDLQGxy4Fcn6F1IIDj7Gj9HPFjGtwdSDBMwMJ+b8J3p oH32ohnN9ZWXy9RWGY7acNxfpwgQ9jmOGyDKW4Go6WdoxVwpra3FwiviWEyd/S92z2y+ zKsbhfwyLOuu7PThfH5pq5UKvAMKLmNhTm2yc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=EUtMEntt0PfCS+QA++565B+ISD4Jym/aI9wcXEx9J0syouXpy6pfcv6CW34bgomhHf RDyPSxne8dB0/g0I2jNW1PmXf8njO7bzWGf3IzM1NA0kfGuZGoX23esgyNcgpvDLsoi6 AZcjNU1UoyVJge17Q8Jxnz4KTaIiU+xxGS6A8= MIME-Version: 1.0 Received: by 10.101.184.1 with SMTP id l1mr3471828anp.198.1262802871445; Wed, 06 Jan 2010 10:34:31 -0800 (PST) In-Reply-To: <4B42CFCC.3030501@bogus.com> References: <4B29DEE9.1090202@bogus.com> <4B42CFCC.3030501@bogus.com> Date: Thu, 7 Jan 2010 00:04:31 +0530 Message-ID: <92c950311001061034n148c6ecdi7dde1ec8c0b16b8b@mail.gmail.com> From: Glen Kent To: Joel Jaeggli Content-Type: text/plain; charset=ISO-8859-1 Cc: "opsec@ietf.org" Subject: Re: [OPSEC] (deadline for last call is 1/7/10) Working Group last call for draft-ietf-opsec-routing-protocols-crypto-issues-02 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jan 2010 18:34:36 -0000 I could find some small nits which need to get fixed: (1) Section 1 (Problem Statement) does not mention BFD, which is discussed later in the draft. (2) Section 2 (OSPFv2) only talks about MD5 support; OSPFv2 now has been extended to support HMAC-SHA and the draft needs to be updated with this. (3) Section 6.1 (Technical Issues with RIP) states the following: o RIPv2 [RFC2453] does not specify the use of any particular hash algorithm. Currently, RIP implementations only support keyed MD5 [RFC2082]. This is again incorrect as RIP has been extended to support stronger algorithms. Glen On Tue, Jan 5, 2010 at 11:06 AM, Joel Jaeggli wrote: > Just as a reminder there remain three days to submitt comments before > the last call window closes. > > Thanks > joel > > Joel Jaeggli wrote: >> This is the working group Last call for >> draft-ietf-opsec-routing-protocols-crypto-issues-02 >> >> Please review the current draft: >> >> http://tools.ietf.org/html/draft-ietf-opsec-routing-protocols-crypto-issues-02 >> >> Deadline for Comments is 0000 UTC, Thurs Jan 7th 2010. the extended >> period is to account for the compound set of holidays occuring in a >> number of locations within the immediate two week period. >> >> As per the minutes the thinking is that this draft will be aimed at >> informational status. >> >> thanks >> joel >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www.ietf.org/mailman/listinfo/opsec >> > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > From Donald.Smith@qwest.com Wed Jan 6 11:26:40 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F23AD28C114 for ; Wed, 6 Jan 2010 11:26:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZqF-6KBmKaBN for ; Wed, 6 Jan 2010 11:26:39 -0800 (PST) Received: from sudnp799.qwest.com (sudnp799.qwest.com [155.70.32.99]) by core3.amsl.com (Postfix) with ESMTP id EF1E83A687E for ; Wed, 6 Jan 2010 11:26:38 -0800 (PST) Received: from suomp60i.qintra.com (suomp60i.qintra.com [151.117.69.27]) by sudnp799.qwest.com (8.14.0/8.14.0) with ESMTP id o06JQYfV006392; Wed, 6 Jan 2010 12:26:34 -0700 (MST) Received: from qtdenexhtm22.AD.QINTRA.COM (localhost [127.0.0.1]) by suomp60i.qintra.com (8.14.0/8.14.0) with ESMTP id o06JQRSQ027475; Wed, 6 Jan 2010 13:26:28 -0600 (CST) Received: from qtdenexmbm24.AD.QINTRA.COM ([151.119.91.226]) by qtdenexhtm22.AD.QINTRA.COM ([151.119.91.231]) with mapi; Wed, 6 Jan 2010 12:26:06 -0700 From: "Smith, Donald" To: "'Glen Kent'" , "'Joel Jaeggli'" Date: Wed, 6 Jan 2010 12:26:05 -0700 Thread-Topic: [OPSEC] noted: draft-dugal-opsec-protect-control-plane-00 Thread-Index: AcqO/WichlVsVSmJRLmpqhwhVrotnwACF8Tw Message-ID: References: <4B42CE9B.8070505@bogus.com> <92c950311001061023i39dd830eqd4fe2568f7106400@mail.gmail.com> In-Reply-To: <92c950311001061023i39dd830eqd4fe2568f7106400@mail.gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "'cpignata@cisco.com'" , "'opsec@ietf.org'" Subject: Re: [OPSEC] noted: draft-dugal-opsec-protect-control-plane-00 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jan 2010 19:26:40 -0000 I am certainly not an IETF expert so will leave that to others but I found = the document to be interesting and valuable. Most router vendors will NOT provide cpp numbers to ISPs. Other ISPs have a= sked me what numbers we are using on the Qwest network so ISPs are interest= ed in something like this with actual values in it and the reasoning behind= those values. I would be willing to review and provide comments on this draft! (coffee !=3D sleep) & (!coffee =3D=3D sleep) Donald.Smith@qwest.com gcia > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] > On Behalf Of Glen Kent > Sent: Wednesday, January 06, 2010 11:24 AM > To: Joel Jaeggli > Cc: cpignata@cisco.com; opsec@ietf.org > Subject: Re: [OPSEC] noted: draft-dugal-opsec-protect-control-plane-00 > > I read the draft and i am not sure i understand the motivation of why > this needs to get published as an IETF standard. > > Am i missing something here? > > Glen > > On Tue, Jan 5, 2010 at 11:01 AM, Joel Jaeggli > wrote: > > I notes with interest today the initial publication of: > > > > > http://tools.ietf.org/html/draft-dugal-opsec-protect-control-plane-00 > > > > for which I am certain review and feedback would be greatly > appreciated. > > > > thanks > > > > joel > > _______________________________________________ > > OPSEC mailing list > > OPSEC@ietf.org > > https://www.ietf.org/mailman/listinfo/opsec > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments. From rodunn@cisco.com Mon Jan 11 10:42:28 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C7EBA3A6824 for ; Mon, 11 Jan 2010 10:42:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cRZtiEJo7Y8M for ; Mon, 11 Jan 2010 10:42:27 -0800 (PST) Received: from av-tac-rtp.cisco.com (hen.cisco.com [64.102.19.198]) by core3.amsl.com (Postfix) with ESMTP id BAAE43A67F4 for ; Mon, 11 Jan 2010 10:42:27 -0800 (PST) X-TACSUNS: Virus Scanned Received: from rooster.cisco.com (localhost.cisco.com [127.0.0.1]) by av-tac-rtp.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id o0BIgMOU022145; Mon, 11 Jan 2010 13:42:22 -0500 (EST) Received: from dhcp-64-102-157-217.cisco.com (dhcp-64-102-157-217.cisco.com [64.102.157.217]) by rooster.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id o0BIgMja018958; Mon, 11 Jan 2010 13:42:22 -0500 (EST) Message-ID: <4B4B710E.6010406@cisco.com> Date: Mon, 11 Jan 2010 13:42:22 -0500 From: Rodney Dunn Organization: Cisco Systems Inc. User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.5) Gecko/20091204 Thunderbird/3.0 MIME-Version: 1.0 To: "Smith, Donald" References: <4B42CE9B.8070505@bogus.com> <92c950311001061023i39dd830eqd4fe2568f7106400@mail.gmail.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: "'opsec@ietf.org'" , "'cpignata@cisco.com'" Subject: Re: [OPSEC] noted: draft-dugal-opsec-protect-control-plane-00 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: rodunn@cisco.com List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jan 2010 18:42:28 -0000 Thanks Donald. We do appreciate any and all feedback and review comments. You can reach all of us via: draft-dugal-opsec-protect-control-plane@tools.ietf.org Or unicast any of us and we'll get together on the feedback. Rodney On 1/6/10 2:26 PM, Smith, Donald wrote: > I am certainly not an IETF expert so will leave that to others but I found the document to be interesting and valuable. > Most router vendors will NOT provide cpp numbers to ISPs. Other ISPs have asked me what numbers we are using on the Qwest network so ISPs are interested in something like this with actual values in it and the reasoning behind those values. > > I would be willing to review and provide comments on this draft! > > (coffee != sleep)& (!coffee == sleep) > Donald.Smith@qwest.com gcia > >> -----Original Message----- >> From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] >> On Behalf Of Glen Kent >> Sent: Wednesday, January 06, 2010 11:24 AM >> To: Joel Jaeggli >> Cc: cpignata@cisco.com; opsec@ietf.org >> Subject: Re: [OPSEC] noted: draft-dugal-opsec-protect-control-plane-00 >> >> I read the draft and i am not sure i understand the motivation of why >> this needs to get published as an IETF standard. >> >> Am i missing something here? >> >> Glen >> >> On Tue, Jan 5, 2010 at 11:01 AM, Joel Jaeggli >> wrote: >>> I notes with interest today the initial publication of: >>> >>> >> http://tools.ietf.org/html/draft-dugal-opsec-protect-control-plane-00 >>> >>> for which I am certain review and feedback would be greatly >> appreciated. >>> >>> thanks >>> >>> joel >>> _______________________________________________ >>> OPSEC mailing list >>> OPSEC@ietf.org >>> https://www.ietf.org/mailman/listinfo/opsec >>> >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www.ietf.org/mailman/listinfo/opsec >> > > This communication is the property of Qwest and may contain confidential or > privileged information. Unauthorized use of this communication is strictly > prohibited and may be unlawful. If you have received this communication > in error, please immediately notify the sender by reply e-mail and destroy > all copies of the communication and any attachments. > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec From rodunn@cisco.com Mon Jan 11 10:55:23 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9A1083A6836 for ; Mon, 11 Jan 2010 10:55:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g9aNI083t4vc for ; Mon, 11 Jan 2010 10:55:22 -0800 (PST) Received: from av-tac-rtp.cisco.com (hen.cisco.com [64.102.19.198]) by core3.amsl.com (Postfix) with ESMTP id AC66C3A63C9 for ; Mon, 11 Jan 2010 10:55:22 -0800 (PST) X-TACSUNS: Virus Scanned Received: from rooster.cisco.com (localhost.cisco.com [127.0.0.1]) by av-tac-rtp.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id o0BItIOO022870; Mon, 11 Jan 2010 13:55:18 -0500 (EST) Received: from dhcp-64-102-157-217.cisco.com (dhcp-64-102-157-217.cisco.com [64.102.157.217]) by rooster.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id o0BItHEv007421; Mon, 11 Jan 2010 13:55:17 -0500 (EST) Message-ID: <4B4B7415.1080204@cisco.com> Date: Mon, 11 Jan 2010 13:55:17 -0500 From: Rodney Dunn Organization: Cisco Systems Inc. User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.5) Gecko/20091204 Thunderbird/3.0 MIME-Version: 1.0 To: Glen Kent References: <4B42CE9B.8070505@bogus.com> <92c950311001061023i39dd830eqd4fe2568f7106400@mail.gmail.com> In-Reply-To: <92c950311001061023i39dd830eqd4fe2568f7106400@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: cpignata@cisco.com, "opsec@ietf.org" Subject: Re: [OPSEC] noted: draft-dugal-opsec-protect-control-plane-00 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: rodunn@cisco.com List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jan 2010 18:55:23 -0000 Glen, Thanks for reading through it. The consensus of the authors was that we would aim for an Informational draft (http://tools.ietf.org/html/rfc1796) and the idea is that it helps support the Goals and Scope of OPSEC: https://www.ietf.org/dyn/wg/charter/opsec-charter.html Hopefully it raises the awareness of network operators to do more to protect the control plane of the network infrastructure devices. Similar in concept to how RTBHF was highlighted via RFC 5635 to help in the data plane: https://www.ietf.org/rfc/rfc5635.txt Rodney On 1/6/10 1:23 PM, Glen Kent wrote: > I read the draft and i am not sure i understand the motivation of why > this needs to get published as an IETF standard. > > Am i missing something here? > > Glen > > On Tue, Jan 5, 2010 at 11:01 AM, Joel Jaeggli wrote: >> I notes with interest today the initial publication of: >> >> http://tools.ietf.org/html/draft-dugal-opsec-protect-control-plane-00 >> >> for which I am certain review and feedback would be greatly appreciated. >> >> thanks >> >> joel >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www.ietf.org/mailman/listinfo/opsec >> From joelja@bogus.com Mon Jan 11 20:01:33 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6A0D93A684A for ; Mon, 11 Jan 2010 20:01:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OY15Mb4LY-fn for ; Mon, 11 Jan 2010 20:01:32 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id 21DC63A6967 for ; Mon, 11 Jan 2010 20:01:32 -0800 (PST) Received: from [192.168.1.131] (c-98-234-104-156.hsd1.ca.comcast.net [98.234.104.156]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o0C41TqC078100 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 12 Jan 2010 04:01:29 GMT (envelope-from joelja@bogus.com) Message-ID: <4B4BF40E.4050606@bogus.com> Date: Mon, 11 Jan 2010 20:01:18 -0800 From: joel jaeggli User-Agent: Thunderbird 2.0.0.23 (Windows/20090812) MIME-Version: 1.0 To: "'opsec@ietf.org'" References: <4B29DEE9.1090202@bogus.com> <4B42CFCC.3030501@bogus.com> In-Reply-To: <4B42CFCC.3030501@bogus.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Tue, 12 Jan 2010 04:01:29 +0000 (UTC) Subject: Re: [OPSEC] (deadline for last call is 1/7/10) Working Group last call for draft-ietf-opsec-routing-protocols-crypto-issues-02 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jan 2010 04:01:33 -0000 The comment period on this draft has closed... glens comments have been noted and will be incorporated prior to submission to the iesg. a notice will be posted when the updated draft is ready. joel Joel Jaeggli wrote: > Just as a reminder there remain three days to submitt comments before > the last call window closes. > > Thanks > joel > > Joel Jaeggli wrote: >> This is the working group Last call for >> draft-ietf-opsec-routing-protocols-crypto-issues-02 >> >> Please review the current draft: >> >> http://tools.ietf.org/html/draft-ietf-opsec-routing-protocols-crypto-issues-02 >> >> Deadline for Comments is 0000 UTC, Thurs Jan 7th 2010. the extended >> period is to account for the compound set of holidays occuring in a >> number of locations within the immediate two week period. >> >> As per the minutes the thinking is that this draft will be aimed at >> informational status. >> >> thanks >> joel >> _______________________________________________ >> OPSEC mailing list >> OPSEC@ietf.org >> https://www.ietf.org/mailman/listinfo/opsec >> > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > From joelja@bogus.com Mon Jan 11 20:42:48 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF4573A6989 for ; Mon, 11 Jan 2010 20:42:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oEtI5wN+JiZu for ; Mon, 11 Jan 2010 20:42:48 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id 22AF53A697F for ; Mon, 11 Jan 2010 20:42:48 -0800 (PST) Received: from [192.168.1.131] (c-98-234-104-156.hsd1.ca.comcast.net [98.234.104.156]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o0C4giZB080161 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 12 Jan 2010 04:42:45 GMT (envelope-from joelja@bogus.com) Message-ID: <4B4BFDBA.2030303@bogus.com> Date: Mon, 11 Jan 2010 20:42:34 -0800 From: joel jaeggli User-Agent: Thunderbird 2.0.0.23 (Windows/20090812) MIME-Version: 1.0 To: "'opsec@ietf.org'" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Tue, 12 Jan 2010 04:42:45 +0000 (UTC) Subject: [OPSEC] Next task: draft-bhatia-manral-igp-crypto-requirements-04 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jan 2010 04:42:49 -0000 http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requirements-04 To briefly recounted the saga as I know it, it has been discussed on this list before. Was presented in opsec first at ietf 74 with significant group feedback, and resulted in a spirited discussion on this list, including some extremely helpful commentary from RJ Atkinson on the attack surface of the various currently in-use algorithms. Subsequently the authors sought and received commentary from the security ad's. The resulting document is ready for testing of wg acceptance. It is my understanding that the intended status of this document is informational. Glen Kent noted his support for the current document on 12/16. Comment period will run 1 calender week 1/11-1/18 --- WG chair hat off, I think the draft could still use of tweaks to the overall tone before it goes to last call, I see that value as guidance to implementors and perhaps operators rather than as guidance to the routing area, the work that will produce these protocol will necessarily occur separately from this document itself. I have a significant hand in changes between draft 03 and draft 04 for so I'm not entirely unbiased when it some to the current state, but I think it's pretty good. use of lower chase should in terms of addressing future requirements I think adequately conveys that this doucment recommends protocol changes but is not itself imposing those recommendations. thanks joel From root@core3.amsl.com Thu Jan 21 09:15:04 2010 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 906133A6A9C; Thu, 21 Jan 2010 09:15:01 -0800 (PST) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20100121171503.906133A6A9C@core3.amsl.com> Date: Thu, 21 Jan 2010 09:15:02 -0800 (PST) Cc: opsec@ietf.org Subject: [OPSEC] I-D ACTION:draft-ietf-opsec-routing-protocols-crypto-issues-03.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Jan 2010 17:15:05 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. Title : Issues with existing Cryptographic Protection Methods for Routing Protocols Author(s) : J. Jaeggli, S. Hares, M. Bhatia, V. Manral, R. White Filename : draft-ietf-opsec-routing-protocols-crypto-issues-03.txt Pages : 17 Date : 2010-1-21 Routing protocols have over time been extended to use cryptographic mechanisms to validate data being received from a neighboring router to ensure that: o it has not been modified in transit. o actually originated from an authorized neighboring router . The cryptographic mechanisms defined to date and described in this document rely on a digest produced with a hash algorithm applied to the payload encapsulated in the routing protocol packet. This document outlines some of the limitations of the current mechanism, problems with manual keying of these cryptographic algorithms, and possible vectors for the exploitation of these limitations. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-opsec-routing-protocols-crypto-issues-03.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-opsec-routing-protocols-crypto-issues-03.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-1-21090052.I-D@ietf.org> --NextPart-- From joelja@bogus.com Sun Jan 24 11:04:20 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 42EF33A682E for ; Sun, 24 Jan 2010 11:04:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Irrc0eMDRHf0 for ; Sun, 24 Jan 2010 11:04:19 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id 5DE203A6818 for ; Sun, 24 Jan 2010 11:04:19 -0800 (PST) Received: from [192.168.1.151] (c-98-234-104-156.hsd1.ca.comcast.net [98.234.104.156]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o0OJ4JPc039792 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Sun, 24 Jan 2010 19:04:21 GMT (envelope-from joelja@bogus.com) Message-ID: <4B5C9362.5090407@bogus.com> Date: Sun, 24 Jan 2010 10:37:22 -0800 From: Joel Jaeggli User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: "'opsec@ietf.org'" References: <4B4BFDBA.2030303@bogus.com> In-Reply-To: <4B4BFDBA.2030303@bogus.com> X-Enigmail-Version: 0.96.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Sun, 24 Jan 2010 19:04:21 +0000 (UTC) Subject: Re: [OPSEC] Next task: draft-bhatia-manral-igp-crypto-requirements-04 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Jan 2010 19:04:20 -0000 Postive comments on the inclusion of this draft, were recieved from glen kent 12/16 and Alfred Hines. Unlike the previous round of discussion on this draft not comments to the contrary, were registered. In light of ou declared intent to bring it to the list for acceptance at the IETF 76 meeting it is plausible to conclude, that we should accept this work as a working group item and ammed our milestones accordingly. while the comment period has ended, anyone who believes otherwise should please contact me. Thank you Joel joel jaeggli wrote: > http://tools.ietf.org/html/draft-bhatia-manral-igp-crypto-requirements-04 > > To briefly recounted the saga as I know it, it has been discussed on > this list before. Was presented in opsec first at ietf 74 with > significant group feedback, and resulted in a spirited discussion on > this list, including some extremely helpful commentary from RJ Atkinson > on the attack surface of the various currently in-use algorithms. > Subsequently the authors sought and received commentary from the > security ad's. > > The resulting document is ready for testing of wg acceptance. It is my > understanding that the intended status of this document is informational. > > Glen Kent noted his support for the current document on 12/16. > > Comment period will run 1 calender week 1/11-1/18 > > --- > > WG chair hat off, > > I think the draft could still use of tweaks to the overall tone before > it goes to last call, I see that value as guidance to implementors and > perhaps operators rather than as guidance to the routing area, the work > that will produce these protocol will necessarily occur separately from > this document itself. > > I have a significant hand in changes between draft 03 and draft 04 for > so I'm not entirely unbiased when it some to the current state, but I > think it's pretty good. use of lower chase should in terms of addressing > future requirements I think adequately conveys that this doucment > recommends protocol changes but is not itself imposing those > recommendations. > > thanks > joel > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > From root@core3.amsl.com Fri Jan 29 13:15:02 2010 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 6762F3A694A; Fri, 29 Jan 2010 13:15:01 -0800 (PST) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20100129211502.6762F3A694A@core3.amsl.com> Date: Fri, 29 Jan 2010 13:15:01 -0800 (PST) Cc: opsec@ietf.org Subject: [OPSEC] I-D ACTION:draft-ietf-opsec-igp-crypto-requirements-00.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jan 2010 21:15:02 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. Title : Cryptographic Authentication Algorithm Implementation Best Practices for Routing Protocols Author(s) : M. Bhatia, V. Manral Filename : draft-ietf-opsec-igp-crypto-requirements-00.txt Pages : 10 Date : 2010-1-30 The routing protocols Open Shortest Path First version 2 (OSPFv2) [RFC2328], Intermediate System to Intermediate System (IS-IS) [ISO] [RFC1195] and Routing Information Protocol (RIP) [RFC2453] currently define Clear Text and MD5 (Message Digest 5) [RFC1321] methods for authenticating protocol packets. Recently effort has been made to add support for the SHA (Secure Hash Algorithm) family of hash functions for the purpose of authenticating routing protocol packets for RIP [RFC4822], IS-IS [RFC5310] and OSPF [RFC5709]. To encourage interoperability between disparate implementations, it is imperative that we specify the expected minimal set of algorithms thereby ensuring that there is at least one algorithm that all implementations will have in common. This document examines the current set of available algorithms with interoperability and effective cryptographic authentication protection being the principle considerations. Cryptographic authentication of these routing protocols requires the availability of the same algorithms in disparate implementations. It is desirable that newly specified algorithms should be implemented and available in routing protocol implementations because they may be promoted to requirements at some future time. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-opsec-igp-crypto-requirements-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-opsec-igp-crypto-requirements-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-1-29131313.I-D@ietf.org> --NextPart--