Subject: [secdir] Review of draft-ietf-ccamp-wson-impairments-07

From: Nico Williams <[email-masked]>
Date: Wed, 12 Oct 2011 02:05:27 -0500

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

This document targets the informative (FYI) track and describes a
framework for applying GMPLS protocols to handle information about
link quality (my words) based on "Impairment Aware Routing and
Wavelength Assignment (IA-RWA)".  Given the document's intended status
and the fact that no protocols as such are specified, it would seem
that the sparse security considerations section should suffice, except
that it's not clear whether active attacks are of concern (the
security considerations section concenrs itself mostly with privacy
concerns).  A few words on the potential for active attacks would be
useful, particularly for the non-initiate.

The I-D is not properly formatted (e.g., the abstract is not on the
first page, and plenty of other formatting errors follow).  Assuming
that these errors are corrected and that the security considerations
section is updated as indicated above, I think this I-D should be
ready.

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Wed, 12 Oct 2011 13:00:59 -0500

On Wed, Oct 12, 2011 at 12:30 PM, Leeyoung <[email-masked]> wrote:
> Modified security section reads:
>
>   This document discusses a number of control plane architectures that
>   incorporate knowledge of impairments in optical networks. If such
>   architecture is put into use within a network it will by its nature
>   contain details of the physical characteristics of an optical
>   network. Such information would need to be protected from intentional
>   or unintentional disclosure similar to other network information used
>   within intra-domain protocols.
>
>   This document does not require changes to the security models within
>   GMPLS and associated protocols.  That is, the OSPF-TE, RSVP-TE, and
>   PCEP security models could be operated unchanged. However, satisfying
>   the requirements for impairment information dissemination using the existing
>   protocols may significantly affect the loading of those protocols.
>   This may make the operation of the network more vulnerable to denial-
>   of-service attacks or active attacks.  Therefore, additional care maybe
>   required to ensure that the protocols are secure in the impairment-aware
>   WSON environment.
>
>   Furthermore, the additional information distributed in order to
>   address impairment information represents a disclosure of network
>   capabilities that an operator may wish to keep private. Consideration
>   should be given to securing this information.  For a general discussion
>   on MPLS- and GMPLS-related security issues, see the MPLS/GMPLS security
>   framework [RFC5920].
>
> Please suggest some texts if these are not satisfactory to your need. Thanks.

I'm not concerned about denial of service attacks in particular as it
is often the case that there are denial of service attack surfaces
about which there's little we can do.  What I'm concerned about is
whether the framework can handle active attacks such as injections,
impersonation, and MITMs.  The reference to OSPF and friends is
probably sufficient in this regard for me to figure out an answer,
though saying something to the effect that a) you rely on such
protocols for security (your proposed change says so), and b) that
those protocols meet whatever you think the requirements ought to be
for IA-RWA.  Oh, and I suppose you should c) list what you think those
requirements are.  Of course, if these protocols don't today meet
those requirements, then that'd be a problem, but I suspect that won't
prove to be the case.

This is one of those occasions where it's good to ask "what's your
threat model" too.  My guess is that there isn't that much of a threat
from eavesdropping on IA-RWA, so passive attackers are not part of the
threat model.  What active attacks might be in the threat model?

Nico
--

---

From: Leeyoung <[email-masked]>
Date: Wed, 12 Oct 2011 17:30:54 +0000

Hi Nico,

Thanks for your review and giving us your comments on security section. 
Please review the following changes. 

The current security section reads: 

   This document discusses a number of control plane architectures that
   incorporate knowledge of impairments in optical networks. If such
   architecture is put into use within a network it will by its nature
   contain details of the physical characteristics of an optical
   network. Such information would need to be protected from intentional
   or unintentional disclosure similar to other network information used
   within intra-domain protocols. It is expected that protocol solutions
   work will address any issues on the use of impairment information.

Best Regards, 
Young

-----Original Message-----
From: Nico Williams [mailto:[email-masked]] 
Sent: Wednesday, October 12, 2011 2:05 AM
To: [email-masked]; [email-masked]; [email-masked]
Subject: Review of draft-ietf-ccamp-wson-impairments-07

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Wed, 19 Oct 2011 10:14:18 -0500

On Tue, Oct 18, 2011 at 10:16 PM, Leeyoung <[email-masked]> wrote:
> As you indicated in the latest response, this document is first of all informational and does not define any new protocols beyond the family of OSPF-TE, RSVP-TE and PCEP. There are no new requirements caused by IA-RWA other than the need for processing additional routing/signaling related data beyond the regular TE networks.
> These additional data would not add any particular security requirements in my opinion.

The fact that this is an informational document doesn't mean there's
no need to be thorough.  On the contrary, since a beginner to the
subject might start by reading the informational documents, this one's
a good place to discuss security issues.

> Anyhow, please see the following changes if you would be satisfied with them.

I'm happy with the proposed text.  Thanks!

Nico
--

---

From: Leeyoung <[email-masked]>
Date: Wed, 19 Oct 2011 03:16:46 +0000

Hi Nicole,

------------------------------------------------------------------------

This document does not require changes to the security models within
GMPLS and associated protocols.  That is, the OSPF-TE, RSVP-TE, and
PCEP security models could be operated unchanged. However, satisfying
the requirements for impairment information dissemination using the existing
protocols may significantly affect the loading of those protocols.
This may make the operation of the network more vulnerable to active attacks 
such as injections, impersonation, and MITMs. Therefore, additional care maybe
required to ensure that the protocols are secure in the impairment-aware
WSON environment.

-------------------------------------------------------------------------------

Best Regards,
Young

-----Original Message-----
From: Nico Williams [mailto:[email-masked]] 
Sent: Wednesday, October 12, 2011 1:01 PM
To: Leeyoung
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: Review of draft-ietf-ccamp-wson-impairments-07

Nico
--

---

From: Leeyoung <[email-masked]>
Date: Fri, 21 Oct 2011 04:33:50 +0000

Hi Nico,

Thanks for your thorough review and suggestions, and accepting the modified texts. 

Best Regards,
Young

-----Original Message-----
From: Nico Williams [mailto:[email-masked]] 
Sent: Wednesday, October 19, 2011 10:14 AM
To: Leeyoung
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: Review of draft-ietf-ccamp-wson-impairments-07

Nico
--