Subject: Security review of draft-ietf-pce-questions-06

From: Ben Laurie <[email-masked]>
Date: Fri, 4 Jul 2014 13:09:52 +0100

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Status: ready with issues.

The security considerations section makes this claim:

"This informational document does not define any new protocol elements
or mechanism.  As such, it does not introduce any new security
issues."

I agree with the premise, but not the conclusion: just because an RFC
does not introduce new security issues, that does not mean that there
are no security considerations.

Indeed, this RFC discusses many things that have quite serious
security considerations, without mentioning any of them. For example,
section 4 "How Do I Find My PCE?" (the very first question) advocates
a number of potentially completely insecure mechanisms with no mention
of their security properties (or otherwise). This is obviously
pervasive, given the stance taken in the security considerations.

The document does mention that RFC 6952 gives a security analysis for
PCEP, and perhaps this is sufficient but it seems to me that a
document intended to give useful background information to noobs
should include security directly in that information rather than defer
to another giant document (which mixes PCEP info with other
protocols).

---

From: "Adrian Farrel" <[email-masked]>
Date: Wed, 9 Jul 2014 09:55:11 +0100

Hi Ben,

Thanks for taking the time to review this document and for posting your comments to the IETF discussion list so that we can consider them as last call comments.

[snip]

> to another giant document (which mixes PCEP info with other

I don't believe that this document is strong on "advocacy", but discusses which tools are out there and what some people do.

Previous PCE RFCs have given some attention to security concerns in the use of PCE (RFC 4655), PCE discovery (RFC 4674, RFC 5088. RFC 5089), and the PCEP (RFC 4657 and RFC 5440). As such, "PCE Security" was not deemed by the authors to be a previously "unanswered question" and so did not need attention in this document.

That said, you are correct that the various sections do not discuss the security implications relating to those sections. I would be pretty loathe to add security text to each section in this document: I think that would make the document heavy and less likely to be read by its intended consumers (it is not targeting "noobs" although they are welcome to read it).

Perhaps a solution to this *is* to treat Security as an unanswered question and add a section "How Secure is my PCE-Enabled System?" I can't think of a lot to add there except for general egg-sucking guidance, but there would be a pointer to the TCP-AO discussions currently going on in the WG. What do you think of that as a way forward?

Thanks,
Adrian

---

From: Ben Laurie <[email-masked]>
Date: Wed, 9 Jul 2014 15:04:27 +0100

> That said, you are correct that the various sections do not discuss the security implications relating to those sections. I would be pretty loathe to add security text to each section in this docum…

Your position appears to be that they will then go on to read much
heavier documents in order to discover the security properties of the
solutions you suggest, which seems a little unlikely, particularly if
there's no mention of the necessity to do so.

Or perhaps you think security is not important?

> Perhaps a solution to this *is* to treat Security as an unanswered question and add a section "How Secure is my PCE-Enabled System?" I can't think of a lot to add there except for general egg-sucki…

I have no idea what discussions are going on, but once more, if you
are concerned about "heaviness" of documentation, pointing at ongoing
discussions does not strike me as a route to lightness.

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 09 Jul 2014 11:05:35 +0200

On 07/09/2014 10:55 AM, Adrian Farrel wrote:
> I would be pretty loathe to add security text to each section in this document: I think that would make the document heavy and less likely to be read by its intended consumers

I like that one.

I think I will quote you in the future as someone who had said

"Adding security text to a specification makes the document heavy and
less likely to be read by its intended consumers."

Ciao
Hannes

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 10 Jul 2014 16:55:27 +0100

Hannes,

You can say what you like, but I would appreciate not being misquoted on serious
matters even in jest.

Yes, you cut from my email correctly. Then you entirely missed the point and
reworded differently. That is neither helpful nor constructive. Doing so in a
sarcastic or caustic manner is not good for the atmosphere on this list.

>From time to time people complain to me (as AD, I'm an author for this document)
about the tone on this list and the way it harms participation of newcomers.
Please don't put yourself into that category.

Adrian

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]]
> Sent: 09 July 2014 10:06
> To: [email-masked]; 'Ben Laurie'; 'IETF Discussion List'; [email-masked]
> Cc: [email-masked]
> Subject: Re: [secdir] Security review of draft-ietf-pce-questions-06
> 
> 
> 
> > I would be pretty loathe to add security text to each section in this
document: I
> think that would make the document heavy and less likely to be read by its
> intended consumers
> 
> I like that one.
>

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 10 Jul 2014 16:58:23 +0100

Hi Ben,

So you don't like my proposed solution?

I am not quite sure what you do consider a resolution to your concern. I can see three options:

1. Add security-related text to each section of this document.
2. Beef up the Security Considerations section with a subsection related to each section of the document.
3. Add a new section "How Secure is my PCE-Enabled System?" as I suggested.

Do you have a preference among these, or is there another option you like better?

Thanks,
Adrian

> From: Ben Laurie [mailto:[email-masked]]
> Sent: 09 July 2014 15:04
> To: [email-masked]
> Cc: IETF Discussion List; [email-masked]; The IESG
> Subject: Re: Security review of draft-ietf-pce-questions-06
> 
> > Thanks for taking the time to review this document and for posting your
> comments to the IETF discussion list so that we can consider them as last call
> comments.
> >
> > [snip]
> >
> > I don't believe that this document is strong on "advocacy", but discusses which
> tools are out there and what some people do.
> >
> > Previous PCE RFCs have given some attention to security concerns in the use of
> PCE (RFC 4655), PCE discovery (RFC 4674, RFC 5088. RFC 5089), and the PCEP (RFC
> 4657 and RFC 5440). As such, "PCE Security" was not deemed by the authors to be
> a previously "unanswered question" and so did not need attention in this
> document.
> >
> > That said, you are correct that the various sections do not discuss the security
> implications relating to those sections. I would be pretty loathe to add security
> text to each section in this document: I think that would make the document
> heavy and less likely to be read by its intended consumers (it is not targeting
> "noobs" although they are welcome to read it).
> 
> > Perhaps a solution to this *is* to treat Security as an unanswered question and
> add a section "How Secure is my PCE-Enabled System?" I can't think of a lot to
> add there except for general egg-sucking guidance, but there would be a pointer
> to the TCP-AO discussions currently going on in the WG. What do you think of
> that as a way forward?
>

---

From: Ben Laurie <[email-masked]>
Date: Thu, 10 Jul 2014 17:02:11 +0100

> Do you have a preference among these, or is there another option you like better?

I prefer 1, that way the security advice is likely to be read by
whoever reads that section - that is, by the people who are likely to
benefit from it.

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 10 Jul 2014 17:21:06 +0100

OK, thanks, that's clear what you'd like.

Not sure I like the approach, but I now have something to chew on. I'll get back to you.

A

> Sent: 10 July 2014 17:02

---

From: Eric Gray <[email-masked]>
Date: Thu, 17 Jul 2014 01:14:34 +0000

Adrian,

	I think it might be useful to have a little more information in the Security 
Considerations section.

	For the example Ben gives, for example, the draft could include text in 
the SC section that makes the point Ben made and refers to the RFCs (or other 
places) where these issues have been discussed or addressed.

	I am not sure the suggestion was to put security text in each section so
much as to put pointers to relevant places where (admittedly not new) security 
issues have already been hashed out.

	I don't think this would be the first draft that had an SC section listing
the issues (old or new) that apply to other sections in the same draft.

--
Eric

-----Original Message-----
From: ietf [mailto:[email-masked]] On Behalf Of Adrian Farrel
Sent: Wednesday, July 09, 2014 4:55 AM
To: 'Ben Laurie'; 'IETF Discussion List'; [email-masked]
Cc: [email-masked]
Subject: RE: Security review of draft-ietf-pce-questions-06

Hi Ben,

[snip]

Thanks,
Adrian

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 17 Jul 2014 12:57:58 +0100

Hi Eric,

Ben has clarified...

> I prefer 1 [Add security-related text to each section of this document], that
> way the security advice is likely to be read by whoever reads that section - 
> that is, by the people who are likely to benefit from it.

I've agreed to look at this, but i find myself a tiny bit busy. There is a meeting I have to go to at the end of the week and I have to prepare some material.

Will get to this in due course.

A

> From: Eric Gray [mailto:[email-masked]]
> Sent: 17 July 2014 02:15