Subject: Re: [karp] secdir review of draft-ietf-karp-ops-model-07

From: Sam Hartman <[email-masked]>
Date: Wed, 14 Aug 2013 11:18:39 -0400

>>>>> "Radia" == Radia Perlman <[email-masked]> writes:

    Radia>    I think the document would be much improved with an
    Radia> introduction about what is different for "routing protocol
    Radia> security" rather than, say, an endnode authenticating to an
    Radia> access point, or nodes forming a peer relationship in an
    Radia> overlay network.  So, for instance, "normal security issues"
    Radia> (i.e., outside the scope of KARP) might assume the network is
    Radia> up, so that it's possible to get CRLs, or be available to be
    Radia> managed, whereas perhaps KARP is targetting cases which
    Radia> depend on less infrastructure.  It would be nice if this
    Radia> document were to have an introduction that talks about things
    Radia> like that.

I think that one of the previous KARP documents  (the overview or design
guide) includes  a good review of that material.  I know I've seen a
good write up of this in the KARP context before.
KARP folks can you help jog my memory so I can add a reference?

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 14 Aug 2013 08:29:46 -0700

Sam,

I think you are referring to RFC 4948 and RFC 6518.

On Aug 14, 2013, at 8:18 AM, Sam Hartman wrote:

> _______________________________________________
> karp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/karp

Mahesh Jethanandani
[email-masked]

---

From: Brian Weis <[email-masked]>
Date: Wed, 14 Aug 2013 10:28:32 -0700

> KARP folks can you help jog my memory so I can add a reference?

This is a valuable point. But I can't find that good write-up in an RFC or I-D. Actually, Section 4.4 (The role of Central Servers) of this document has the best description conveying the point that minimal infrastructure is desirable. 

The best I find is RFC 6862, Section 1.1 Terminology, under Identity Authentication: "Certificates can be used in ways that require no additional supporting systems external to the routers themselves." That does not fully convey the thought that but could be referenced.

Brian