From rpsec-bounces@ietf.org Tue May 01 20:29:13 2007
Return-path: <rpsec-bounces@ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com)
	by megatron.ietf.org with esmtp (Exim 4.43)
	id 1Hj2iT-00012i-Op; Tue, 01 May 2007 20:29:09 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org)
	by megatron.ietf.org with esmtp (Exim 4.43) id 1Hj2iT-00012d-5T
	for rpsec@ietf.org; Tue, 01 May 2007 20:29:09 -0400
Received: from an-out-0708.google.com ([209.85.132.244])
	by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Hj2iS-0007xa-TK
	for rpsec@ietf.org; Tue, 01 May 2007 20:29:09 -0400
Received: by an-out-0708.google.com with SMTP id d30so1913693and
	for <rpsec@ietf.org>; Tue, 01 May 2007 17:29:08 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=AElOp6dLqJPP8qQKvHfHnQACiB+TLo5BphQqJlLy34uiIXllSGuov71XPmAjrt40ZSxz14ge/3xKrGDQKfkdJkFSMi1h95Dkq1PfoUpyKDPT21IgBbfHaSkOHyFRjwMy2JWRaBOLEGCIVby867+sGiLnzUHsBSqHUt+GfqbM8PU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=a8ptyXMCk7WFEGJ0bi3aykbvTFmFAga2T+qjRzwQJsPjPRD5X9KVlxJAmkFBlDwaCzGhSl5AB6Umi2rT9f0wkWMMVg6gH3asnTpWCxQt+AFXD859veSYnlJS2BH96y8KHBHKIsvz+eMcp39IqB3echRd8RmV5bl/glpmsLCDfVE=
Received: by 10.100.126.2 with SMTP id y2mr44768anc.1178065748539;
	Tue, 01 May 2007 17:29:08 -0700 (PDT)
Received: by 10.100.153.14 with HTTP; Tue, 1 May 2007 17:29:08 -0700 (PDT)
Message-ID: <e60e52770705011729k5ac216e5l555e649472b37be7@mail.gmail.com>
Date: Wed, 2 May 2007 05:59:08 +0530
From: "R Gilmore" <ralph.gilmore@gmail.com>
To: rpsec@ietf.org
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8
Subject: [RPSEC] RE: Issues with existing Cryptographic Protection Methods
	forRouting Protocols
X-BeenThere: rpsec@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Routing Protocol Security Requirements  <rpsec.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/rpsec>,
	<mailto:rpsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/rpsec>
List-Post: <mailto:rpsec@ietf.org>
List-Help: <mailto:rpsec-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/rpsec>,
	<mailto:rpsec-request@ietf.org?subject=subscribe>
Errors-To: rpsec-bounces@ietf.org

Hi,

The abstract seems to be strangely worded and i had problems parsing
it <hehe>. It seems you missed some words in the second line.

There is a draft by Bonica et. al. that enhances the security provided
for TCP. You may want to include that in your text for BGP ..

R.

> -----Original Message-----
> From: Bhatia, Manav (Manav) [mailto:manav@alcatel-lucent.com]
> Sent: Tuesday, May 01, 2007 7.30 AM
> To: rpsec@ietf.org
> Subject: [RPSEC] Issues with existing Cryptographic
> Protection Methods forRouting Protocols
>
> Hi,
>
> The routing protocols crypto issues draft was discussed in
> the RPSEC WG
> some time back and we have now posted an updated version of
> the same. We
> would be interested in the comments from the WG.
>
> The URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-manral-rpsec-existin
> g-crypto-0
> 4.txt
>
> Routing protocols often use cryptographic mechanisms to authenticate
> data being received from a neighboring router assuming that it has not
> been modified in transit, and actually originated from the neighboring
> router purporting to have originating the data.  Most of the
> cryptographic mechanisms rely on hash algorithms applied to
> the data in
> the routing protocol packet, which means the data is
> transported, in the
> clear, along with the has signature based on the data itself.  These
> mechanisms rely on the manual configuration of the keys used
> to seed, or
> build, these hash based signatures.  This document outlines
> some of the
> problems with manual keying of these cryptographic algorithms and some
> attacks that the current routing protocols are vulnerable to despite
> using the cryptographic authentication methods described for
> each one of
> them.
>
> Cheers,
> Russ, Vishwas and Manav
>
> _______________________________________________
> RPSEC mailing list
> RPSEC@ietf.org
> https://www1.ietf.org/mailman/listinfo/rpsec
>

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec



From rpsec-bounces@ietf.org Tue May 15 05:00:39 2007
Return-path: <rpsec-bounces@ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com)
	by megatron.ietf.org with esmtp (Exim 4.43)
	id 1HnstK-0006aE-AT; Tue, 15 May 2007 05:00:22 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org)
	by megatron.ietf.org with esmtp (Exim 4.43) id 1HnstI-0006a1-Qq
	for rpsec@ietf.org; Tue, 15 May 2007 05:00:20 -0400
Received: from ams-iport-1.cisco.com ([144.254.224.140])
	by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HnstI-0003yj-8Q
	for rpsec@ietf.org; Tue, 15 May 2007 05:00:20 -0400
Received: from ams-dkim-1.cisco.com ([144.254.224.138])
	by ams-iport-1.cisco.com with ESMTP; 15 May 2007 11:00:19 +0200
Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150])
	by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id l4F90J2B014999
	for <rpsec@ietf.org>; Tue, 15 May 2007 11:00:19 +0200
Received: from xbh-ams-331.emea.cisco.com (xbh-ams-331.cisco.com
	[144.254.231.71])
	by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id l4F90JDR029444
	for <rpsec@ietf.org>; Tue, 15 May 2007 09:00:19 GMT
Received: from xfe-ams-331.emea.cisco.com ([144.254.231.72]) by
	xbh-ams-331.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); 
	Tue, 15 May 2007 11:00:19 +0200
Received: from mbehring-wxp.cisco.com ([10.55.2.210]) by
	xfe-ams-331.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); 
	Tue, 15 May 2007 11:00:18 +0200
X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9
Date: Tue, 15 May 2007 11:00:17 +0200
To: rpsec@ietf.org
From: "Michael H. Behringer" <mbehring@cisco.com>
Mime-Version: 1.0
Message-ID: <XFE-AMS-331HfqR77bi000005a2@xfe-ams-331.emea.cisco.com>
X-OriginalArrivalTime: 15 May 2007 09:00:19.0071 (UTC)
	FILETIME=[765028F0:01C796CF]
DKIM-Signature: v=0.5; a=rsa-sha256; q=dns/txt; l=4419; t=1179219619;
	x=1180083619; c=relaxed/simple; s=amsdkim1002;
	h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version;
	d=cisco.com; i=mbehring@cisco.com;
	z=From:=20=22Michael=20H.=20Behringer=22=20<mbehring@cisco.com>
	|Subject:=20BGP=20session=20security=20requirement=20draft,=20-01
	|Sender:=20; bh=Pu7ixHCqGbESaTvrr9R1dxBnS+4oX5yJpQ4lclI1pUI=;
	b=YrknrYUZNYV/egNpi/bct8vW4clrF3ZeXBUIC69d9oQ4r87bYJJGAslgIsGPrE2Z4poWv7Vg
	uztgLvEBvF3bTW32jNY26QkFr+sKU1XVlAk9piMsPe8Kbu+3cfluJlQi;
Authentication-Results: ams-dkim-1; header.From=mbehring@cisco.com; dkim=pass (
	sig from cisco.com/amsdkim1002 verified; ); 
X-Spam-Score: 0.1 (/)
X-Scan-Signature: 1a1bf7677bfe77d8af1ebe0e91045c5b
Subject: [RPSEC] BGP session security requirement draft, -01
X-BeenThere: rpsec@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Routing Protocol Security Requirements  <rpsec.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/rpsec>,
	<mailto:rpsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/rpsec>
List-Post: <mailto:rpsec@ietf.org>
List-Help: <mailto:rpsec-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/rpsec>,
	<mailto:rpsec-request@ietf.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============0407272420=="
Errors-To: rpsec-bounces@ietf.org

--===============0407272420==
Content-Type: multipart/alternative;
	boundary="=====================_479205281==.ALT"

--=====================_479205281==.ALT
Content-Type: text/plain; charset="us-ascii"

Incorporating all comments I received so far (thanks!) I published version -01 of the draft. 

http://www.ietf.org/internet-drafts/draft-behringer-bgp-session-sec-req-01.txt

Many comments I got suggested to add stories, examples, etc. So far my approach has been to be "minimalistic", and to really focus on the bare requirements, and leave out ornaments. Sandy commented that we need to move quickly on this draft, so keeping it "to the point" seems the right approach to me. 

Since this is a work item on the charter, I would like to request this document to become a WG draft, and to move it on from there. 

Any comments are appreciated. 

Thanks, 
Michael


>Date: Mon, 26 Feb 2007 19:13:41 +0100
>To: Russ White <riw@cisco.com>, rpsec@ietf.org
>From: "Michael H. Behringer" <mbehring@cisco.com>
>Subject: Re: [RPSEC] Charter and Meeting Agenda
>
>Russ, all, 
>
>At 15:37 06/01/2007, Russ White wrote:
>[...]
>>o P-2-P security requirements for BGP: This was to provide some cover
>>and thinking on the various TCP auth mechanisms to replace MD5 that are
>>currently being considered. We need, I believe, a volunteer to
>>author/edit this, and get it moving.
>[...]
>
>I had a go at that topic, please see below. This still needs quite some content and editing; for now, I would like to ask for feedback on the abstract / intro (to make sure the problem is described correctly), and the outline of the draft. Is this the way we want to go down here? Please let me know your opinion. 
>
>
>
>
>http://www.ietf.org/internet-drafts/draft-behringer-bgp-session-sec-req-00.txt
>
>
>Cheers, 
>Michael 
>_______________________________________________
>RPSEC mailing list
>RPSEC@ietf.orghttps://www1.ietf.org/mailman/listinfo/rpsec

--=====================_479205281==.ALT
Content-Type: text/html; charset="us-ascii"

<html>
<body>
Incorporating all comments I received so far (thanks!) I published
version -01 of the draft. <br><br>
<a href="http://www.ietf.org/internet-drafts/draft-behringer-bgp-session-sec-req-01.txt" eudora="autourl">
http://www.ietf.org/internet-drafts/draft-behringer-bgp-session-sec-req-01.txt<br>
<br>
</a>Many comments I got suggested to add stories, examples, etc. So far
my approach has been to be &quot;minimalistic&quot;, and to really focus
on the bare requirements, and leave out ornaments. Sandy commented that
we need to move quickly on this draft, so keeping it &quot;to the
point&quot; seems the right approach to me. <br><br>
Since this is a work item on the charter, I would like to request this
document to become a WG draft, and to move it on from there. <br><br>
Any comments are appreciated. <br><br>
Thanks, <br>
Michael<br><br>
<br>
<blockquote type=cite class=cite cite="">Date: Mon, 26 Feb 2007 19:13:41
+0100<br>
To: Russ White &lt;riw@cisco.com&gt;, rpsec@ietf.org<br>
From: &quot;Michael H. Behringer&quot; &lt;mbehring@cisco.com&gt;<br>
Subject: Re: [RPSEC] Charter and Meeting Agenda<br><br>
Russ, all, <br><br>
At 15:37 06/01/2007, Russ White wrote:<br>
[...]<br>
<blockquote type=cite class=cite cite="">o P-2-P security requirements
for BGP: This was to provide some cover<br>
and thinking on the various TCP auth mechanisms to replace MD5 that
are<br>
currently being considered. We need, I believe, a volunteer to<br>
author/edit this, and get it moving.</blockquote>[...]<br><br>
I had a go at that topic, please see below. This still needs quite some
content and editing; for now, I would like to ask for feedback on the
abstract / intro (to make sure the problem is described correctly), and
the outline of the draft. Is this the way we want to go down here? Please
let me know your opinion. <br><br>
<br>
<pre>
<a href="http://www.ietf.org/internet-drafts/draft-behringer-bgp-session-sec-req-00.txt" eudora="autourl">
</a>
http://www.ietf.org/internet-drafts/draft-behringer-bgp-session-sec-req-00.txt<a href="http://www.ietf.org/internet-drafts/draft-behringer-bgp-session-sec-req-00.txt" eudora="autourl">

</a></pre><br>
Cheers, <br>
Michael <br>
_______________________________________________<br>
RPSEC mailing list<br>
RPSEC@ietf.org<a href="https://www1.ietf.org/mailman/listinfo/rpsec" eudora="autourl">
https://www1.ietf.org/mailman/listinfo/rpsec</a></blockquote></body>
</html>

--=====================_479205281==.ALT--


--===============0407272420==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec

--===============0407272420==--




From rpsec-bounces@ietf.org Tue May 15 10:07:42 2007
Return-path: <rpsec-bounces@ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com)
	by megatron.ietf.org with esmtp (Exim 4.43)
	id 1Hnxgg-0007S0-0W; Tue, 15 May 2007 10:07:38 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org)
	by megatron.ietf.org with esmtp (Exim 4.43) id 1Hnxge-0007M5-Jp
	for rpsec@ietf.org; Tue, 15 May 2007 10:07:36 -0400
Received: from ns1.tislabs.com ([192.94.214.100] helo=nutshell.tislabs.com)
	by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Hnxgd-0004bc-D0
	for rpsec@ietf.org; Tue, 15 May 2007 10:07:36 -0400
Received: (from uucp@localhost)
	by nutshell.tislabs.com (8.12.9/8.12.9) id l4FE5bu5007823;
	Tue, 15 May 2007 10:05:37 -0400 (EDT)
Received: from pecan.tislabs.com(10.66.1.30) by nutshell.tislabs.com via csmap
	(V6.0) id srcAAAwcairp; Tue, 15 May 07 10:05:33 -0400
Received: by pecan.tislabs.com (Postfix, from userid 2005)
	id 479813F463; Tue, 15 May 2007 10:04:13 -0400 (EDT)
To: mbehring@cisco.com, rpsec@ietf.org
Subject: Re: [RPSEC] BGP session security requirement draft, -01
In-Reply-To: <XFE-AMS-331HfqR77bi000005a2@xfe-ams-331.emea.cisco.com>
Message-Id: <20070515140413.479813F463@pecan.tislabs.com>
Date: Tue, 15 May 2007 10:04:13 -0400 (EDT)
From: sandy@tislabs.com (Sandy Murphy)
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014
Cc: sandy@tislabs.com
X-BeenThere: rpsec@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Routing Protocol Security Requirements  <rpsec.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/rpsec>,
	<mailto:rpsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/rpsec>
List-Post: <mailto:rpsec@ietf.org>
List-Help: <mailto:rpsec-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/rpsec>,
	<mailto:rpsec-request@ietf.org?subject=subscribe>
Errors-To: rpsec-bounces@ietf.org

>Sandy commented that we need to move quickly on this draft, so keeping
>it "to the point" seems the right approach to me.

The need for speed was to keep ahead of the tcpm design team that is
working on some way to change or replace the TCP MD5 mechanism.  

That isn't proving to be a problem.  ;-{

--Sandy

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec