Subject: [secdir] secdir review of draft-ietf-grow-filtering-threats-06

From: Tom Yu <[email-masked]>
Date: Tue, 07 Jul 2015 15:10:11 -0400

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors.  Document editors and WG chairs should treat these
comments just like any other last call comments.

Summary: Ready with nits

Consider adding text to the Introduction mentioning malicious activity
as a possible cause of these unexpected traffic flows, rather than
leaving it toward the end of the document in the Security
Considerations.

The Security Considerations (Section 6) text describes possible
malicious activity by an AS to deliberately cause unexpected traffic
flow through another AS.  Although the first paragraph of the Security
Considerations says "The objective of this document is to inform on this
potential routing security issue", there appears to be no prior mention
in this document of possibility of maliciously induced unexpected
traffic flow.  The current Introduction characterizes the unexpected
traffic flows primarily as side effects of filtering or other
configuration, but appears not to include the possibility of a malicious
cause.

Editorial:

In the second paragraph of Section 1: "While BGP" should be "Although
BGP", to avoid implying dependency or temporal coincidence.

In the first two paragraphs of Section 3.1, "his" should be "its".
Please avoid the unnecessary use of gendered pronouns.

In the first paragraph of Section 3.2, delete "data" from "as much data
information as possible".

For the title of Section 4, consider dropping one instance of the word
"traffic".

In the last paragraph of Section 4.1, in the sentence "...neighboring
AS... opposes the peering agreement", consider replacing "opposes" with
"contravenes", "infringes", or another synonym.

---

From: Pierre Francois <[email-masked]>
Date: Wed, 8 Jul 2015 17:05:26 +0200

Tom,

Thanks a lot for your review. Comments inline.

Pierre.

> On 07 Jul 2015, at 21:10, Tom Yu <[email-masked]> wrote:
> 

We agree. However, we got feedback in the past that the same technical situation can occur without malicious intent and so were asked to reword
the draft without implying malicious intent. We heard at the mic “I’ve done it and I am not evil”, “This is traffic engineering, not an attack”.

Still, we were recommended to put this explanation in the security consideration section because, well, it can also happen due to malicious intent
(gaining reach for cheap through another party's network).

I’m afraid that by changing this again, I’d be starting another revolution (in the mathematical sense) here… but what about:

Introduction:

OLD: The objective of this draft is to shed light on possible side effects associated with more specific prefix filtering. This document presents examples of such side effects and discusses approaches towards solutions to the problem.

NEW:  The objective of this draft is to shed light on possible side effects associated with such more specific prefix filtering.
Such actions can be explained by traffic engineering action, misconfiguration, or malicious intent.
This document presents examples of such side effects and discusses approaches towards solutions to the problem.

> "contravenes", "infringes", or another synonym.

Thank you !

Cheers,

Pierre.