Subject: [secdir] secdir review of draft-ietf-mpls-tp-itu-t-identifiers

From: "Dan Harkins" <[email-masked]>
Date: Thu, 3 Jan 2013 11:04:51 -0800 (PST)

Hello, and happy new year,

  I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

  This draft creates a new globally unique identifier for the Transport
Profile of MPLS. RFC 6370, which created identifiers for MPLS-TP,
uses the operator's AS as a globally unique identifier but this draft
proposes an alternative: use the ITU-T Carrier Codes. It then goes
about changing the identifiers created by RFC 6370 by substituting
the ITU-T Carrier Code for the AS.

  The security considerations state that the draft merely extends an
information model and does not propose any protocol changes and
therefore it does not introduce any new security concerns. This seems
acceptable except that this extension relies on the global uniqueness
of the ITU-T Carrier Codes (as RFC 6370 relies on the AS to be
globally unique). Apparently "national regulatory authorities"
ensure that they are unique in their regulatory domain (which is an
ISO 3166-1 identified code) so as long as they don't screw up
anything all is well. I think it might be worth mentioning the
assumption that the "national regulatory authorities" will not make a
mistake and what happens if they do. RFC 6370 relied on IANA to
not make a mistake; this draft relies on all 249 entities that have an
official code in ISO 3166-1 to not make a mistake.

  Also, there is a normative reference to a "Corrigendum" of an ITU-T
recommendation on "OAM functions and mechanisms for Ethernet
based networks". I have never encountered such a document. Is it
a stable reference?

  regards,

  Dan.

---

From: "Adrian Farrel" <[email-masked]>
Date: Sat, 5 Jan 2013 15:37:58 -0000

Hi Dan,

The authors may care to comment further, but I think there are two points...

The regulatory codes are centrally allocated so the "screw-ups" that you refer
to are within those domains. That reduces the scope of the problem and also
reduces its impact. But maybe the document would benefit from a note on the
"risks of misconfiguration". I am not sure that that would belong in the
Security Considerations section, but space could certainly be found in the
document.

Yes, Corrigenda are stable ITU-T references. They are found on the same web page
that gives download pointers for the Recommendations they correct.

Cheers,
Adrian

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Dan
> Harkins
> Sent: 03 January 2013 19:05
> To: [email-masked]; [email-masked]; draft-ietf-mpls-tp-itu-t-
> [email-masked]
> Subject: secdir review of draft-ietf-mpls-tp-itu-t-identifiers
> 
>

---

From: Huub helvoort <[email-masked]>
Date: Mon, 7 Jan 2013 13:58:37 +0000

Hello Dan,

Thank you for the review.

Adrian already addressed your concerns, I would like to provide soem extra information.
See my comments in-line [Huub]

________________________________________
From: Adrian Farrel [[email-masked]]
Sent: 05 January 2013 16:37
To: 'Dan Harkins'
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: RE: secdir review of draft-ietf-mpls-tp-itu-t-identifiers

Hi Dan,

reduces its impact.

[Huub] correct, each country is responsible for allocating and using unique operator
identification codes: the ICC. This is explained on this page:
http://www.itu.int/oth/T0201
To make them globally unique the CC has to be added.

 But maybe the document would benefit from a note on the
"risks of misconfiguration". I am not sure that that would belong in the
Security Considerations section, but space could certainly be found in the
document.

[Huub] would a reference to http://www.itu.int/oth/T0201  be enough?

[Huub] see http://www.itu.int/ITU-T/recommendations/rec.aspx?id=11136&lang=en

Best regards, Huub.

--
================================================================
Always remember that you are unique...just like everyone else...