Subject: [Isis-wg] Ben Campbell's No Objection on draft-ietf-isis-auto-conf-04: (with COMMENT)

From: Ben Campbell <[email-masked]>
Date: Wed, 12 Apr 2017 13:51:28 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-isis-auto-conf-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-isis-auto-conf/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

-4: "In general, the use of authentication is incompatible with auto-
   configuration as it requires some manual configuration."

What are the consequences/risks due to that incompatibility?

---

From: "Les Ginsberg (ginsberg)" <[email-masked]>
Date: Wed, 12 Apr 2017 21:40:18 +0000

Ben -

Thanx for the review.
Inline.

> -----Original Message-----
> From: Ben Campbell [mailto:[email-masked]]
> Sent: Wednesday, April 12, 2017 1:51 PM
> To: The IESG
> Cc: [email-masked]; Hannes Gredler; [email-masked];
> [email-masked]; [email-masked]
> Subject: Ben Campbell's No Objection on draft-ietf-isis-auto-conf-04: (with
> COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 

[Les:] The "incompatibility" is that now some manual configuration is required.
The intent of the draft is to define a profile such that a compliant implementation could simply boot up w/o any configuration and be able to interoperate with other routers running in auto-config mode. If authentication is desired then at a minimum the authentication key has to be configured which means the zero touch capability is compromised. That is all we are trying to say.

   Les

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 12 Apr 2017 21:36:38 -0500

On 12 Apr 2017, at 16:40, Les Ginsberg (ginsberg) wrote:

>> email
>> Please refer to 
>> https://www.ietf.org/iesg/statement/discuss-criteria.html
> The intent of the draft is to define a profile such that a compliant 
> implementation could simply boot up w/o any configuration and be able 
> to interoperate with other routers running in auto-config mode. If 
> authentication is desired then at a minimum the authentication key has 
> to be configured which means the zero touch capability is compromised. 
> That is all we are trying to say.

Sorry, my question was not clear. Obviously there is value in running in 
auto-config mode, and some people might choose to skip authentication so 
they can do it. Is it possible to give a brief description (or cite one 
elsewhere) of the tradeoffs involved in that decision?

---

From: "Les Ginsberg (ginsberg)" <[email-masked]>
Date: Thu, 13 Apr 2017 05:01:55 +0000

Ben -

> Sent: Wednesday, April 12, 2017 7:37 PM
> To: Les Ginsberg (ginsberg)
> Cc: The IESG; [email-masked]; [email-masked]; isis-
> [email-masked]; [email-masked]
> Subject: Re: Ben Campbell's No Objection on draft-ietf-isis-auto-conf-04:
> (with COMMENT)
> 
> >> Cc: [email-masked]; Hannes Gredler;
> >> [email-masked]; [email-masked]; [email-masked]
> >> email addresses included in the To and CC lines. (Feel free to cut
> >> this introductory paragraph, however.)
> >>
> >>
> >> Please refer to
> Sorry, my question was not clear. Obviously there is value in running in auto-
> config mode, and some people might choose to skip authentication so they
> can do it. Is it possible to give a brief description (or cite one
[Les:] Based on previous security related comments we have agreed to modify the Security section to say:

"In the absence of cryptographic authentication it is possible for an attacker to inject  a PDU falsely indicating  there is a duplicate system-id. This may trigger automatic restart of the protocol using the duplicate-id resolution procedures defined in this document. 

Note that the use of authentication is incompatible with auto- configuration as it requires some manual configuration.
..."

Will that suffice?

   Les

---

From: "Ben Campbell" <[email-masked]>
Date: Thu, 13 Apr 2017 00:04:07 -0500

On 13 Apr 2017, at 0:01, Les Ginsberg (ginsberg) wrote:

> "In the absence of cryptographic authentication it is possible for an 
> attacker to inject  a PDU falsely indicating  there is a duplicate 
> system-id. This may trigger automatic restart of the protocol using 
> the duplicate-id resolution procedures defined in this document.
>
> Note that the use of authentication is incompatible with auto- 
> configuration as it requires some manual configuration.
> ..."
>
> Will that suffice?

That's exactly what I was looking for, thanks!

Ben.