Subject: [Idr] Roman Danyliw's No Objection on draft-ietf-idr-eag-distribution-16: (with COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Tue, 18 May 2021 06:10:39 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-idr-eag-distribution-16: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-idr-eag-distribution/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Per Section 4 (Security Considerations),

It is assumed that the IGP instances originating this TLV
   will support all the required security (as described in [RFC7308]) in
   order to prevent any security issues when propagating the TLVs into
   BGP-LS.

The Security Considerations (Section 3) of RFC7308 reads "This extension adds
no new security considerations."  What guidance is this sentence providing?

---

From: Jeff Tantsura <[email-masked]>
Date: Tue, 18 May 2021 22:38:16 -0500

Hi Roman,

Thanks for your review.

I see your point, practically, this draft uses  BGP-LS (RFC7752) to transport IGP data, and 7752 talks in details about security considerations.
The security section of RFC7308 is indeed quite short.
Would adding references to security sections of  OSPFv2 (RFC 3630), OSPFv3 (RFC 5329) and IS-IS (RFC 5305) work for you?

Thanks!

Cheers,
Jeff

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 18 May 2021 21:12:11 -0700

Hi Jeff,

I'm not Roman, but I would have made the same comment.

I don't think that this is quite a question of "just" adding more
references -- the -16 currently says that there is some kind of
"required security [mechanisms?]" from the IGP, and that RFC 7308 specifies
how to achieve that level of required security.  While RFC 7308 clearly is
not a good reference for that, the question as to what the "required
security [mechanisms?]" is/are remains unanswered.  Once we know the answer
to that, we can give better guidance about what references to use and how
to write the text using those references.

Thanks,

Ben

---

From: Roman Danyliw <[email-masked]>
Date: Wed, 19 May 2021 22:04:21 +0000

Hi Jeff!

Ben spoke eloquently on my behalf.  My thinking is exactly as Ben describes it below ...

Roman

> -----Original Message-----
> From: Benjamin Kaduk <[email-masked]>
> Sent: Wednesday, May 19, 2021 12:12 AM
> To: Jeff Tantsura <[email-masked]>
> Cc: The IESG <[email-masked]>; Roman Danyliw <[email-masked]>; draft-ietf-idr-
> [email-masked]; [email-masked]; [email-masked]; Susan Hares
> <[email-masked]>; [email-masked]
> Subject: Re: Roman Danyliw's No Objection on draft-ietf-idr-eag-distribution-
> 16: (with COMMENT)
> 
> Hi Jeff,
> 
> I don't think that this is quite a question of "just" adding more references -- the
> -16 currently says that there is some kind of "required security [mechanisms?]"
> from the IGP, and that RFC 7308 specifies how to achieve that level of required
> security.  While RFC 7308 clearly is not a good reference for that, the question
> as to what the "required security [mechanisms?]" is/are remains unanswered.
> Once we know the answer to that, we can give better guidance about what
> references to use and how to write the text using those references.
> 
> Thanks,
> 
> Ben
> 
> > I see your point, practically, this draft uses  BGP-LS (RFC7752) to transport
> IGP data, and 7752 talks in details about security considerations.
> > Would adding references to security sections of  OSPFv2 (RFC 3630), OSPFv3
> (RFC 5329) and IS-IS (RFC 5305) work for you?
> >
> > Thanks!
> >
> > Cheers,
> > Jeff
> > > When responding, please keep the subject line intact and reply to
> > > all email addresses included in the To and CC lines. (Feel free to
> > > cut this introductory paragraph, however.)
> > >
> > >
> > > Please refer to
> > > https://www.ietf.org/iesg/statement/discuss-criteria.html
> > > It is assumed that the IGP instances originating this TLV will
> > > support all the required security (as described in [RFC7308]) in
> > > The Security Considerations (Section 3) of RFC7308 reads "This
> > > extension adds no new security considerations." What guidance is this
> sentence providing?
> > >
> > >
> > >