Subject: Re: [secdir] Secdir review comments for draft-ietf-pim-bidir-08

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 8 Feb 2007 00:20:44 -0500

On Wed, 7 Feb 2007 21:14:35 -0800
"Joseph Salowey (jsalowey)" <[email-masked]> wrote:

> I would like to understand better why ...
> no automated key management
> is specified.   
> 
Do they cite any of the reasons listed in RFC 4107?

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Wed, 7 Feb 2007 21:14:35 -0800

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors.  Document editors and WG chairs should treat these
comments just like any other last call comments.

The security considerations section does a reasonable job of describing
threats against the protocol. It seems also that RFC 4609 might also be
relevant, if it is it should be referenced.  In several cases the
security considerations section suggests using source authentication to
mitigate problems.  The document does list IPSec AH as a way to achieve
this, however this is not a mandatory to implement mechanism.  In
addition this document points to RFC 4601 for direction on how to use
IPSec.  RFC 4601 just specifies manual keying without any specific
parameters.  This leaves the pim-bidr draft (and RFC 4601) without an
specified mandatory to implement interoperable security mechanism.  

This issue was discussed previously during the last call of RFC 4601.  I
would like to understand better why IPSec AH does not have a stronger
requirement and why no automated key management is specified.   

Thanks,

Joe

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Wed, 7 Feb 2007 21:33:58 -0800

> -----Original Message-----
> From: Steven M. Bellovin [mailto:[email-masked]] 
> Sent: Wednesday, February 07, 2007 9:21 PM
> To: Joseph Salowey (jsalowey)
> Cc: [email-masked]; [email-masked]; [email-masked]; 
> Isidor Kouvelas (kouvelas); Tony Speakman (speakman); 
> [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [secdir] Secdir review comments for 
> draft-ietf-pim-bidir-08
> 
[Joe] No, but some of them may apply.  Thanks for the reference
reminder.

---

From: Sam Hartman <[email-masked]>
Date: Thu, 08 Feb 2007 10:52:45 -0500

>>>>> "Steven" == Steven M Bellovin <[email-masked]> writes:

    Steven> On Wed, 7 Feb 2007 21:14:35 -0800
    Steven> "Joseph Salowey (jsalowey)" <[email-masked]> wrote:

    >> I would like to understand better why ...  no automated key
    >> management is specified.
    >> 
    Steven> Do they cite any of the reasons listed in RFC 4107?

No.

Bill gave me a heads up about this a while back because I'd indicated
I would hold a discuss on the next document to do this.  I could not
get together the energy to engage with the WG and cause them to design
a security architecture for PIM.

I at least am planning to abstain on this document because the AD
tried to engage and I failed.  I don't think it's good technology for
this not to have automated key management though.