Subject: RE: [Isis-wg] RE: draft-ietf-isis-hmac-03.txt

From: "Ferrell, William" <[email-masked]>
Date: Tue, 8 Apr 2003 12:51:50 -0400

Hmm... Tony 
From what you can tell thats the summ of my discussion ?
from an IA (Info. Assur.)opinion this is a well balanced and in-depth draft.
"Andersson, et al. RFC 3036 LDP Specification" 

Though its not "short and sweet" This guy showed a deeper knowledge for
operations as well as the true security implications to include real risk
-mitigation. Which concretely conludes that he is profoundly knowledgable of
the technology.
On a lighter note he didnt seem to capture it all into one shallow
statement/question ie.  " So you're suggesting that we trust source
addresses?"
Will
 
-----Original Message-----
From: Tony Li
To: Ferrell, William; Jeff Parker
Cc: ISIS-WG (E-mail)
Sent: 4/8/03 9:54 AM
Subject: RE: [Isis-wg] RE: draft-ietf-isis-hmac-03.txt 

So you're suggesting that we trust source addresses?

Tony

|    -----Original Message-----
|    From: Ferrell, William [mailto:[email-masked]] 
|    Sent: Monday, April 07, 2003 12:08 PM
|    To: 'Jeff Parker'; Ferrell, William
|    Cc: ISIS-WG (E-mail)
|    Subject: RE: [Isis-wg] RE: draft-ietf-isis-hmac-03.txt 
|    
|    
|    Jeff
|    Blunt is cool, and to say that this is an evolution ...WOW.
|    I agree that there are many mitigation techniques the 
|    simplest of course is
|    to ACL with only trusted peers. Thier in lies my issue 
|    with most of these
|    drafts, not much in-depth focus on the security issues.
|    Will
|    
|    -----Original Message-----
|    From: Jeff Parker [mailto:[email-masked]]
|    Sent: Monday, April 07, 2003 2:15 PM
|    To: 'Ferrell, William'
|    Cc: ISIS-WG (E-mail)
|    Subject: RE: [Isis-wg] RE: draft-ietf-isis-hmac-03.txt 
|    
|    
|     
|    > How far did this draft go  ? There are some issues that stood 
|    > to evolve since then :
|    
|    While the expiration date on the draft is in the past, I think 
|    this document is very much alive.  
|    > 
|    >  "This  mechanism  does  not  prevent replay attacks, 
|    however such
|    >  attacks would trigger existing mechanisms in the IS-IS 
|    >  protocol  that would  effectively reject old information.  
|    >  Denial of service attacks are not generally preventable 
|    > in a useful networking protocol [4]."
|    > 
|    > 
|    > While I agree tht the HMAC-MD-5 will not stop replay 
|    > attacks alone but when used in conjuction with the 
|    > protocol will work with the timers and other
|    > mechanism to render the attack useless.
|    > 
|    > My exception is with what clearly seems to be opinion  " 
|    > Denial of service attacks are not generally preventable 
|    > in a useful networking protocol"
|    > 
|    > Before "getting bent out of shape" I realize that there
|    > is always a chance of mis-communication would like a 
|    > full and clearer explanation. The other expanation is 
|    > that this rfc and the writer's opinion has indeed evolved.
|    > Will
|    
|    Will -
|    	First, this proposal is a real advance over prior art.
|    It was much worse before this. 
|    	As to the statement above, it -is- quite difficult to 
|    have a useful routing protocol that doesn't involve trusting
|    the information provided by a third party.  
|    	If you are open to peering with new neighbors, as
|    any IGP with a hello protocol is, you are subject to 
|    DOS attackts.   
|    	If you compromise a router in the network, you 
|    can inject false information into the network, and thus
|    misroute and blackhole traffic, and waste router cycles
|    with spurious SPF recomputations.  
|    	There are things that you can do to mitigate these 
|    effects, but it isn't clear that outlining this is within 
|    the scope of this group. While the language above is blunt, 
|    those are the realities.  
|    
|    - jeff parker
|    _______________________________________________
|    Isis-wg mailing list
|    [email-masked]
|    https://www1.ietf.org/mailman/listinfo/isis-wg
|    _______________________________________________
|    Isis-wg-external mailing list
|    [email-masked]
|    http://mailist.procket.com/mailman/listinfo/isis-wg-external
|    
_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg