Subject: [RPSEC] Charter Update

From: Russ White <[email-masked]>
Date: Sat, 04 Feb 2006 09:05:54 -0500

Y'all:

A second attempt.... See below for a proposed new charter. This should 
be one of the items on the WG meeting agenda at Dallas. I've taken out 
the first work item, although I'm not certain it's the right thing to do.

Please comment, so we can see if there's concensus to move forward.

Thanks!

:-)

Russ

- -- 
[email-masked] CCIE <>< Grace Alone

- --

The lack of a common set of security requirements and methods for
routing protocols has resulted in a wide variety of security
mechanisms for individual routing protocols. Ongoing work on
requirements for the next generation routing system and future work on
the actual mechanisms for it will require well documented routing
security requirements.

The products of this working group will be used by routing protocol
designers to ensure adequate coverage of security in the future,
including well known and possible threats.

The scope of work is limited to router-to-router protocols for unicast
and multicast systems, and does NOT include host-to-router protocol
such as IGMP, ICMP, ARP, or ND. It is also a non-goal at this point to
produce new or change the current security mechanisms in the existing
routing protocols.

The RPSEC working group is charged with the following tasks:

- - Document threat models for routing systems

- - Document security requirements for routing systems

- - Document security analysis and requirements for specific routing
   protocols (e.g., OSPF, BGP)

- - Provide a common area for discussion between security and routing
   experts on the topic of securing the routing system

Goals and Milestones:

July 06 Submit BGP Attack-Tree analysis for publication as
Informational RFC.

July 06 Submit OSPF vulnerability analysis for publication as
Informational RFC.

July 06 Submit BGP security requirements for publication as
Informational RFC.

December 06 Submit initial document discussing security requirements in an
OSPFv3 mobile ad hoc environment

December 06 Evaluate progress, recharter with new goals or shutdown.

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 7 Feb 2006 14:55:46 -0500

Russ,

I think the discussion over the last couple of weeks suggests that 
adding a new, narrowly-defined charter item to address point-to-point 
security to protect BGP sessions between border routers is worthwhile 
and has support from  a number of WG members.

Maybe we need to start with a requirements document, and then move on 
to consider the proposals that are being put forth.

Steve

---

From: Geoff Huston <[email-masked]>
Date: Wed, 08 Feb 2006 08:53:42 +1100

At 06:55 AM 8/02/2006, Stephen Kent wrote:
>Russ,
>
>I think the discussion over the last couple of weeks suggests that adding 
>a new, narrowly-defined charter item to address point-to-point security to 
>protect BGP sessions between border routers is worthwhile and has support 
>from  a number of WG members.
>
>Maybe we need to start with a requirements document, and then move on to 
>consider the proposals that are being put forth.

I would suggest that there is a difference between generating requirements 
and considering proposed solutions

I thought the plan was to define requrements in RPSEC and look at solutions 
in other working groups, such as SIDR.

regards,

    Geoff

---

From: Russ White <[email-masked]>
Date: Tue, 07 Feb 2006 18:24:28 -0500

>> to consider the proposals that are being put forth.

Sure... I can add that.

> I would suggest that there is a difference between generating 
> requirements and considering proposed solutions
> 
> I thought the plan was to define requrements in RPSEC and look at 
> solutions in other working groups, such as SIDR.

Yes, but that still requires a charter change in rpsec, to do the req's doc.

:-)

Russ

- --

---

From: Geoff Huston <[email-masked]>
Date: Wed, 08 Feb 2006 11:16:47 +1100

At 10:24 AM 8/02/2006, Russ White wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>

And that part of the suggestion makes sense to me (to add the req's doc)

    Geoff