Subject: [secdir] Sector Review: draft-ietf-ospf-te-metric-extensions-09

From: Olafur Gudmundsson <[email-masked]>
Date: Sat, 3 Jan 2015 11:44:10 -0500

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments. 

This document is Ready with nits. 

The document contains no issues from a security perspective as it is only creating LSA’s for new types of route selection metrics,
time instead of network hops. 

The Nit that I have is the document in introduction says time is important and the ability to select faster path has high
economical gain. 
The base time measurement unit in the new LSA’s is MICRO seconds, there is no justification in the document that 
says 1 micro second is granular enough for links of the near future (over 100 Gbits+). 

Olafur

---

From: Randy Bush <[email-masked]>
Date: Sun, 04 Jan 2015 09:48:11 +0900

> The document contains no issues from a security perspective as it is
> only creating LSA’s for new types of route selection metrics, time
> instead of network hops.

and the new lsas could not be used in path shortening attacks, right?

randy

---

From: Olafur Gudmundsson <[email-masked]>
Date: Mon, 5 Jan 2015 13:08:47 -0500

> On Jan 3, 2015, at 7:48 PM, Randy Bush <[email-masked]> wrote:
> 

Randy,
this document only defines the format of the LSA’s it does
not talk about processing by the routing engines. 

	Olafur

---

From: John E Drake <[email-masked]>
Date: Mon, 5 Jan 2015 18:42:57 +0000

Olafur,

Link delay is propagation delay and 1 microsecond corresponds to a link with a length of .3 KM.

Yours Irrespectively,

John

From: ietf [mailto:[email-masked]] On Behalf Of Olafur Gudmundsson
Sent: Saturday, January 03, 2015 11:44 AM
To: ietf
Cc: [email-masked]
Subject: Sector Review: draft-ietf-ospf-te-metric-extensions-09

Olafur

---

From: Randy Bush <[email-masked]>
Date: Tue, 06 Jan 2015 06:06:51 +0900

> not talk about processing by the routing engines. 

so the secdir sees no need to warn about it.  got it.  </sarcasm>

randy

---

From: Ben Laurie <[email-masked]>
Date: Mon, 5 Jan 2015 21:18:18 +0000

> so the secdir sees no need to warn about it.  got it.  </sarcasm>

If secdir is going to warn about it through this process, then shortly
the right place to do that is in the comments on the document that
does talk about processing by the routing engines?

---

From: Ben Laurie <[email-masked]>
Date: Mon, 5 Jan 2015 21:18:42 +0000

> If secdir is going to warn about it through this process, then shortly

Good grief. Surely.

---

From: Randy Bush <[email-masked]>
Date: Tue, 06 Jan 2015 06:33:05 +0900

>>> this document only defines the format of the LSA’s it does not talk
>>> about processing by the routing engines.
>>
> If secdir is going to warn about it through this process, then surely

a naïve person might think that all documents in a series that have
security implications would be flagged in the security considerations
section.

but i have had my say.  let's get back to work.

randy

---

From: Ben Laurie <[email-masked]>
Date: Mon, 5 Jan 2015 21:41:17 +0000

> security implications would be flagged in the security considerations

Seriously? What about the implications of other sections? Should they
also be flagged? Or would a naive person perhaps think that to
understand a series, you should read all of it?

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 05 Jan 2015 21:47:49 +0000

> but i have had my say.  let's get back to work.

Yeah, I don't think arguing about it between secdir reviewers
will help us so much:-)

I noted that this had been raised in my ballot ([1] at the end)
and asked if text is needed. Randy - if you have suggested text
that could go in there that'd be good. I'm not clear enough
about the relationship between that attack and this draft to
know what'd be good to be honest.

Cheers,
S.

[1]
https://datatracker.ietf.org/doc/draft-ietf-ospf-te-metric-extensions/ballot/#stephen-farrell

---

From: Randy Bush <[email-masked]>
Date: Tue, 06 Jan 2015 07:09:58 +0900

[ off list as i am over my personal quota for the list ]

> Yeah, I don't think arguing about it between secdir reviewers will
> help us so much:-)

i am not a secdir reviewer, and do not play one on tv

> if you have suggested text that could go in there that'd be good.

users of the lsas described in this document should be aware of how
they might be used in path shortening and other routing attacks.

but i am sure we can make it more complicated :)

randy

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 05 Jan 2015 22:23:09 +0000

> i am not a secdir reviewer, and do not play one on tv

yep, a brain-fart of mine (maybe we'll try rope you in though:-)

> but i am sure we can make it more complicated :)

I added that suggestion to [1] (at end)

S.

[1]
https://datatracker.ietf.org/doc/draft-ietf-ospf-te-metric-extensions/ballot/

---

From: Randy Bush <[email-masked]>
Date: Tue, 06 Jan 2015 07:45:14 +0900

> yep, a brain-fart of mine (maybe we'll try rope you in though:-)

ENOTIME