Subject: [secdir] Secdir review of draft-ietf-sidr-bgpsec-threats-06

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Tue, 24 Sep 2013 06:00:04 +0000

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

This document discusses a threat model for BGP Path Security.   The  document contains a lot of good information, but I found it hard to follow in places  
Some issues:

1.   I found it difficult to link the threats in section 3 to the attacks in section 4.   This is more of a consistency of terminology issue and is probably just a nit. 
2.   The attacks in sections 4.1, 4.2, and 4.3 seem to be largely discounted as out of scope, yet they seem to impact the goals of PATHSEC.   Is it assumed that there are countermeasures in place such as link protection between RGP peers?    If other countermeasures besides PATHSEC are expected to be in place this should probably be mentioned in the security considerations.  
3.   I found the argument against not including 'route leakage' a bit weak since the documents seems to be able to define what it means.   Wouldn't 'route leakage' be a mechanism to realize one or more of the threats in section 3?  

Thanks,

Joe

---

From: Stephen Kent <[email-masked]>
Date: Mon, 30 Sep 2013 12:38:55 -0400

Joe,

> 1.   I found it difficult to link the threats in section 3 to the attacks in section 4.   This is more of a consistency of terminology issue and is probably just a nit.
There is not  1-to-1 correspondence between threats and attacks. So, for 
each attacks in
Section 4, there may be more than one threat that is motivated and 
capable of effecting
the attack.
> 2.   The attacks in sections 4.1, 4.2, and 4.3 seem to be largely discounted as out of scope, yet they seem to impact the goals of PATHSEC.   Is it assumed that there are countermeasures in place s…
The text in 4.1, 4.2, and 4.3 does not say that those attacks are out of 
scope. In 4.1,
there is little text because the attacks are not specific to the 
RPKI/PATHSEC context.
Countermeasures are generic for IP and TCP layer attacks, as noted in 
the requirements
doc. In 4.2 and 4.3 we give a number of examples of these classes of 
attacks, which
is what this doc is intended to do. (Recall, it is not a requirements doc.)
> 3.   I found the argument against not including 'route leakage' a bit weak since the documents seems to be able to define what it means.   Wouldn't 'route leakage' be a mechanism to realize one or…
There is not yet an accepted definition of route leak that represents a 
violation of BGP
specs. The GROW WG is supposed to look into this issue. If it develops a 
suitable proposal, then IDR may elect to modify the BGP spec to address 
the concern.  If IDR does so, SIDR's charter could be modified to 
develop countermeasures for the concern. But, for now, this is out of 
scope. So I disagree with the comment that the argument is weak. Also, 
your use of the term "threat" in the last sentence above is not 
consistent with the way the term is defined and used in Section 3; you 
seem to have switched "threat" and "attack" as well as section numbers.

Steve