Subject: Re: [secdir] SecDir Review of draft-ietf-sidr-bgpsec-reqs-11

From: Randy Bush <[email-masked]>
Date: Fri, 11 Jul 2014 08:13:38 +0900

> 2. Requirement 3.13 indicates that BGPsec “MUST provide backward
>    compatibility”, but we are left to assume that downgrade prevention
>    is enabled.  We might assume that it is, but it’s probably better
>    not to.  Perhaps adding a statement to the effect of “MUST provide
>    backward compatibility…. but also allow for strict BGPsec
>    adherence” or something similar.  I also recognize that there may
>    be obviating circumstances behind this requirement (i.e. it’s not
>    practical to *not* allow strict adherence), which I might also
>    assume as a reader.

i have added the following to sec cons,

    The requirement of backward compatibility to BGP4 may open an avenue
    to downgrade attacks.

> 4. In the Security Considerations section (6) it seems that more
>    explanation pertaining to the following sentence might be
>    warranted: “The data plane might not follow the control plane.”
>    This might be readily apparent to anyone in-the-know, but it’s not
>    so apparent to those not-in-the-know.

per alia atlas

   The data plane might not follow the path signaled by the control
   plane.

randy