Subject: [secdir] secdir review of draft-ietf-l1vpn-ospfv3-auto-discovery

From: Charles Clancy <[email-masked]>
Date: Thu, 20 Nov 2008 17:27:41 -0500

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the IESG. 
  These comments were written primarily for the benefit of the security 
area directors.  Document editors and WG chairs should treat these 
comments just like any other last call comments.

Document: draft-ietf-l1vpn-ospfv3-auto-discovery
Title: OSPFv3 Based Layer 1 VPN Auto-Discovery

Summary: The document defines a mechanism for auto-discovery of 
OSPFv3-based L1 VPNs.  It parallels the RFC 5252 mechanism for 
OSPFv2-based discovery of L1 VPNs, and includes support for IPv6.  It 
specifically only covers transmission of this information between 
provider elements, and not to any customer elements.  The document 
defines a TLV for carrying this information as an OSPFv3 Link State 
Advertisement Type.

The document reuses existing OSPF over IPv6 security mechanisms for 
protecting and authenticating the exchanged TLVs.  This protects against 
many external threats, but does not protect against insider attacks 
(e.g. compromised or misconfigured routers), which could propagate 
invalid L1 VPN information throughout the routing domain.  This is 
documented fully in the referenced supporting documents.

The reviewer finds no specific security issues with the document.

--
t. charles clancy, ph.d.                 eng.umd.edu/~tcc
electrical & computer engineering, university of maryland
_______________________________________________
secdir mailing list
[email-masked]
https://mailman.mit.edu/mailman/listinfo/secdir
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir