Subject: [secdir] SecDir review of draft-ietf-pce-gmpls-aps-req-08

From: Yaron Sheffer <[email-masked]>
Date: Sun, 16 Jun 2013 23:10:47 +0300

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the IESG. 
These comments were written primarily for the benefit of the security 
area directors.  Document editors and WG chairs should treat these 
comments just like any other last call comments.

This document defines additional GMPLS-specific requirements on the PCE 
architecture.

It would be an understatement to characterize this reviewer as a 
non-expert on PCE and GMPLS. That being said, I believe the Security 
Considerations are correct in saying that this document does not add any 
additional security issues on top of PCE.

I would recommend to add a pointer to where such considerations are in 
fact listed, e.g. Sec. 10 of RFC 5440. Though security folks will cringe 
at TCP-MD5 being described as the most practical security solution in 
that section.

Thanks,
	Yaron

---

From: "Adrian Farrel" <[email-masked]>
Date: Sun, 16 Jun 2013 21:14:18 +0100

Hi,

Thanks Yaron.

You're right about pointing to 5440. That document notes that TCP-AO should be
used once it becomes available, and since it has done, a pointer to RFC 6952
would also be helpful.

Cheers,
Adrian

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Yaron
> Sheffer
> Sent: 16 June 2013 21:11
> To: IETF Security Directorate; The IESG; draft-ietf-pce-gmpls-aps-
> [email-masked]
> Subject: SecDir review of draft-ietf-pce-gmpls-aps-req-08
>

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 24 Jun 2013 10:38:49 +0300

Hi Kenichi,

Looks good to me.

Thanks,
	Yaron

On 2013-06-24 03:23, Ogaki, Kenichi wrote:
> Dear Yaron an Adrian,
>
> Thank you for your comments.
>
> To address your comments, we propose the texts for Sec. 4. Security
> Considerations as follows:
>
> PCEP extensions to support GMPLS should be considered under the same
> security as current PCE work and this extension will not change the
> underlying security issues. Sec. 10 of [RFC5440] describes the list of
> security considerations in PCEP. At the time [RFC5440] was published, TCP
> Authentication Option (TCP-AO) had not been fully specified for securing the
> TCP connections that underlie PCEP sessions. TCP-AO [RFC5925] has now been
> published and PCEP implementations should fully support TCP-AO according to
> [RFC6952].
>
> Thanks,
> Kenichi
>
> --
> Kenichi Ogaki
> KDDI | IP Transport Network Development Dept.
> +81-(0)80-5945-9138 | www.kddi.com
>
>> From: Adrian Farrel [mailto:[email-masked]]
>> Sent: Monday, June 17, 2013 5:14 AM
>> To: 'Yaron Sheffer'
>> Cc: 'IETF Security Directorate'; 'The IESG';
>> [email-masked]
>> Subject: RE: SecDir review of draft-ietf-pce-gmpls-aps-req-08
>>
>> Hi,
>>
>> Thanks Yaron.
>>
>> You're right about pointing to 5440. That document notes that TCP-AO
> should
>> be used once it becomes available, and since it has done, a pointer to RFC
>> 6952 would also be helpful.
>>
>> Cheers,
>> Adrian
>>
>>> From: [email-masked] [mailto:[email-masked]] On Behalf
>>> Of Yaron Sheffer
>>> Sent: 16 June 2013 21:11
>>> This document defines additional GMPLS-specific requirements on the
>>> PCE architecture.
>>>
>>> Considerations are correct in saying that this document does not add
>>> any additional security issues on top of PCE.
>>>
>>> fact listed, e.g. Sec. 10 of RFC 5440. Though security folks will
>>> cringe at TCP-MD5 being described as the most practical security
>>> solution in that section.
>>>
>>> Thanks,
>>> 	Yaron
>
>

---

From: "Ogaki, Kenichi" <[email-masked]>
Date: Mon, 24 Jun 2013 09:23:58 +0900

Dear Yaron an Adrian,

Thanks,
Kenichi

should