Subject: [secdir] Security review of draft-shore-icmp-aup-06

From: "Hilarie Orman" <[email-masked]>
Date: Wed, 13 Nov 2013 00:43:52 -0700

Security review of draft-shore-icmp-aup-06
An Acceptable Use Policy for New ICMP Types and Codes

Do not be alarmed.  I have reviewed this document as part of the
security directorate's ongoing effort to review all IETF documents
being processed by the IESG.  These comments were written primarily
for the benefit of the security area directors.  Document editors and
WG chairs should treat these comments just like any other last call
comments.

The document discusses the current uses of ICMP and how it may or may
not fit into management or control planes, depending on your view of
what those are.  The recommendation is to limit uses to reporting
downstream forwarding anomalies, discovering on-link routers and hosts
and network parameters.  "ICMP should not be used as a routing or
network management protocol."

While there are ostensibly no new security considerations, it is
worthwhile noting that ICMP plays a part in the Photuris protocol and
was also used in SKIP (though that usage is deprecated).  In general,
I have some concern about using ICMP to discover network security
parameters or to report on network security anomalies in the
forwarding plane.

I would recommend adding something to the security considerations
about avoiding such usage or using special caution if defining
new protocols.

Hilarie

---

From: Melinda Shore <[email-masked]>
Date: Tue, 12 Nov 2013 23:18:30 -0900

> parameters or to report on network security anomalies in the

I hadn't been aware of its use in Photuris.  We'll get some
text in there mentioning that, as well as some discussion of
the problems you've mentioned with regard to reporting of
security parameters/anomalies.  And now that you mention it
that's actually a more general security problem.

Melinda

-- 
Melinda Shore
No Mountain Software
[email-masked]

"Software longa, hardware brevis."

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Thu, 14 Nov 2013 00:42:15 +0000

Thanks, Hilarie,

How's this updated Security Considerations?

5.  Security considerations

   This document attempts to describe a high-level policy for adding
   ICMP types and codes.  While special attention must be paid to the
   security implications of any particular new ICMP type or code, this
   recommendation presents no new security considerations.

   From a security perspective, ICMP plays a part in the Photuris
   protocol.  But more generally, ICMP is not a secure protocol, and
   does not include features to be used to discover network security
   parameters or to report on network security anomalies in the
   forwarding plane.

Thanks,

-- Carlos.

---

From: Hilarie Orman <[email-masked]>
Date: Wed, 13 Nov 2013 17:43:43 -0700 (MST)

That'll do.

Hilarie

----- Original Message -----
From: Carlos Pignataro (cpignata) <[email-masked]>
To: Melinda Shore <[email-masked]>, Hilarie Orman <[email-masked]>
Cc: <[email-masked]> <[email-masked]>, The IESG <[email-masked]>, [email-masked]
Sent: Wed, 13 Nov 2013 17:42:15 -0700 (MST)
Subject: Re: Security review of draft-shore-icmp-aup-06

Thanks, Hilarie,

Thanks,

-- Carlos.