Subject: [secdir] SECDIR review of draft-ietf-manet-olsrv2-metrics-rationale-02

From: Stephen Kent <[email-masked]>
Date: Wed, 06 Mar 2013 10:40:02 -0500

SECDIR review of draft-ietf-manet-olsrv2-metrics-rationale-02

I reviewed this document as part of the security directorate's ongoing 
effort to review all IETF documents being processed by the IESG.These 
comments were written primarily for the benefit of the security area 
directors.Document editors and WG chairs should treat these comments 
just like any other last call comments.

This document is targeted as an Informational RFC. It describes itself 
as "... an historic record of the rationale for, and design 
considerations behind, how link metrics were included in OLSRv2."

The Security Considerations section says simply "This document does not 
specify any security considerations." It's been a very long time (many 
years) since I've encountered that phrase in a candidate RFC. A 
rationale document itself probably does not entail security 
considerations, but the omission of any security discussion suggests 
that security did not play a role in the deign of this routing protocol. 
Is that true? If so, who thinks this is a good thing?

I looked at the I-D that defines OLSRv2. It contains a two-page Security 
Considerations section. From my perspective, this document ought to 
provide background info (rationale) for the security suggestions 
contained that document.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 06 Mar 2013 12:02:33 -0500

Christopher,

Sorry for my mischaracterization of the scope of this doc.

So, you are saying that there are no security considerations relevant to 
the choice of metrics?

Steve

On 3/6/13 11:37 AM, Dearlove, Christopher (UK) wrote:
>
> Please note that this is not a rationale of OLSRv2.
>
> This is a rationale of how metrics were added to OLSRv2, a small 
> subset of the complete OLSRv2 functionality.
>
> There were of course security considerations in the design of OLSRv2, 
> but this is not that document.
>
> -- 
>
> Christopher Dearlove
>
> Senior Principal Engineer, Communications Group
> Communications, Networks and Image Analysis Capability
> BAE Systems Advanced Technology Centre
> West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
> Tel: +44 1245 242194 |  Fax: +44 1245 242124
>
> [email-masked] <mailto:[email-masked]> | 
> http://www.baesystems.com
>
> BAE Systems (Operations) Limited
> Registered Office: Warwick House, PO Box 87, Farnborough Aerospace 
> Centre, Farnborough, Hants, GU14 6YU, UK
> Registered in England & Wales No: 1996687
>
> *From:*Stephen Kent [mailto:[email-masked]]
> *Sent:* 06 March 2013 15:40
> *To:* secdir; Dearlove, Christopher (UK); [email-masked]; 
> [email-masked]; [email-masked]; 
> [email-masked]; Stewart Bryant; Adrian Farrel
> *Subject:* SECDIR review of draft-ietf-manet-olsrv2-metrics-rationale-02
>
> **** WARNING ****
>
> /This message originates from outside our organisation, either from an 
> external partner or the internet.//
> /Keep this in mind if you answer this message./
> /Please see this process 
> <http://intranet.ent.baesystems.com/howwework/security/spotlights/Documents/Dealing%20With%20Suspicious%20Emails.pdf> 
> on how to deal with suspicious emails.//
>
> effort to review all IETF documents being processed by the IESG.  
> These comments were written primarily for the benefit of the security 
> area directors.  Document editors and WG chairs should treat these 
> comments just like any other last call comments.
>
> The Security Considerations section says simply "This document does 
> not specify any security considerations." It's been a very long time 
> (many years) since I've encountered that phrase in a candidate RFC. A 
> that security did not play a role in the deign of this routing 
> protocol. Is that true? If so, who thinks this is a good thing?
>
> I looked at the I-D that defines OLSRv2. It contains a two-page 
> Security Considerations section. From my perspective, this document 
> ought to provide background info (rationale) for the security 
> suggestions contained that document.
>
>
> ********************************************************************
> This email and any attachments are confidential to the intended
> recipient and may also be privileged. If you are not the intended
> recipient please delete it from your system and notify the sender.
> You should not copy it or use it for any purpose nor disclose or
> distribute its contents to any other person.
> ********************************************************************
>

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Wed, 6 Mar 2013 16:37:28 +0000

This is a rationale of how metrics were added to OLSRv2, a small subset of the complete OLSRv2 functionality.

There were of course security considerations in the design of OLSRv2, but this is not that document.

[email-masked]<mailto:[email-masked]> | http://www.baesystems.com

BAE Systems (Operations) Limited
Registered Office: Warwick House, PO Box 87, Farnborough Aerospace Centre, Farnborough, Hants, GU14 6YU, UK
Registered in England & Wales No: 1996687

From: Stephen Kent [mailto:[email-masked]]
Sent: 06 March 2013 15:40
To: secdir; Dearlove, Christopher (UK); [email-masked]; [email-masked]; [email-masked]; [email-masked]; Stewart Bryant; Adrian Farrel
Subject: SECDIR review of draft-ietf-manet-olsrv2-metrics-rationale-02

*** WARNING ***
This message originates from outside our organisation, either from an external partner or the internet.
Keep this in mind if you answer this message.
Please see this process<http://intranet.ent.baesystems.com/howwework/security/spotlights/Documents/Dealing%20With%20Suspicious%20Emails.pdf> on how to deal with suspicious emails.
SECDIR review of draft-ietf-manet-olsrv2-metrics-rationale-02

I reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document is targeted as an Informational RFC. It describes itself as "... an historic record of the rationale for, and design considerations behind, how link metrics were included in OLSRv2."

The Security Considerations section says simply "This document does not specify any security considerations." It's been a very long time (many years) since I've encountered that phrase in a candidate RFC. A rationale document itself probably does not entail security considerations, but the omission of any security discussion suggests that security did not play a role in the deign of this routing protocol. Is that true? If so, who thinks this is a good thing?

I looked at the I-D that defines OLSRv2. It contains a two-page Security Considerations section. From my perspective, this document ought to provide background info (rationale) for the security suggestions contained that document.

---

From: "Stan Ratliff (sratliff)" <[email-masked]>
Date: Wed, 6 Mar 2013 17:14:47 +0000

FWIW, I agree with Chris - including security concerns for OLSRv2 would be a scope change for the document. The authors were trying to answer the question "Why did you put metrics into OLSRv2, and why did you include them in this specific fashion?" Given that scope, I don't believe there are security issues, and the note in the document is adequate.

Just my 2 cents.

Regards,
Stan

On Mar 6, 2013, at 11:37 AM, Dearlove, Christopher (UK) wrote:

From: Stephen Kent [mailto:[email-masked]]
Sent: 06 March 2013 15:40
To: secdir; Dearlove, Christopher (UK); [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Stewart Bryant; Adrian Farrel
Subject: SECDIR review of draft-ietf-manet-olsrv2-metrics-rationale-02

*** WARNING ***

This document is targeted as an Informational RFC. It describes itself as “… an historic record of the rationale for, and design considerations behind, how link metrics were included in OLSRv2.”

The Security Considerations section says simply “This document does not specify any security considerations.” It’s been a very long time (many years) since I’ve encountered that phrase in a candidate RFC. A rationale document itself probably does not entail security considerations, but the omission of any security discussion suggests that security did not play a role in the deign of this routing protocol. Is that true? If so, who thinks this is a good thing?

---

From: "Adrian Farrel" <[email-masked]>
Date: Wed, 6 Mar 2013 18:29:52 -0000

Hi Stephen,
 
Thanks for this. I wanted to note that this is the rationale for adding metrics
to OLSRv2, not the whole deign rationale for OLSRv2, so there is a big gap
between "consideration of security did not play any part in the design of this
protocol" and "this document does not specify any design considerations".
 
However, I think your point is valid.
 
During my AD review I asked the authors:
 
> Were there any security considerations that cropped up while designing
> metric support in OSLRv2? If so, here would be the place to mention
> them.
 
The authors had no updates they wanted to make to this document and that led me
to conclude:
 
> Security issues arising from the inclusion of metrics in OLSRv2 did
> not get any specific discussion. Since OLSRv2 has its own security
> considerations to cover the whole protocol, there is nothing further
> to say in this document.
 
...a statement which I put to the WG and which they did not refute.
 
So that leads us to wonder: should the addition of a metric to a routing
protocol have been the subject of a discussion about the impact on security. And
if it wasn't, should this document record that it wasn't (and if so, why it
wasn't)?
 
I think that would probably lead to a very short paragraph being inserted in
Section 8 saying "We knew that OSLRv2 already had adequate security so we did
not consider adding metrics in anyway changed the threats or mitigation
expressed in the base specification."
 
Would that have addressed the issue for you?
 
Cheers,
Adrian
 
To: secdir; [email-masked]; [email-masked];
 
SECDIR review of draft-ietf-manet-olsrv2-metrics-rationale-02
I reviewed this document as part of the security directorate's ongoing effort to
review all IETF documents being processed by the IESG.  These comments were
written primarily for the benefit of the security area directors.  Document
editors and WG chairs should treat these comments just like any other last call
comments.
This document is targeted as an Informational RFC. It describes itself as ". an
historic record of the rationale for, and design considerations behind, how link
metrics were included in OLSRv2."
 
The Security Considerations section says simply "This document does not specify
any security considerations." It's been a very long time (many years) since I've
encountered that phrase in a candidate RFC. A rationale document itself probably
does not entail security considerations, but the omission of any security
discussion suggests that security did not play a role in the deign of this
routing protocol. Is that true? If so, who thinks this is a good thing?
 
I looked at the I-D that defines OLSRv2. It contains a two-page Security
Considerations section. From my perspective, this document ought to provide
background info (rationale) for the security suggestions contained that
document.