Subject: [RPSEC] Feedback on draft-behringer-bgp-session-req-01

From: Joe Touch <[email-masked]>
Date: Thu, 21 Jun 2007 13:33:57 -0700

Hi, all,

The following feedback was requested on the TCPM's TCP-AUTH-DT (TCP-Auth
design team) mailing list. TCP-Auth is TCMP's work towards an update to
TCP-MD5, based on two current proposals (noted below).

Joe

---------------------------------------------

This document appears to overlap ongoing work in TCPM to characterize
concerns with using TCP-MD5 to secure BGP, and use of alternatives.
E.g., draft-ietf-tcpm-antispoof. The TCP-Auth team is currently workiing
to revise draft-bellovin-tcpsec, and an update to that should be out
shortly.

Some additional comments:

Sec 1 - the OSI stack is not the reference model for the Internet.
GTSM is not IP layer security; it is a heuristic that checks TTLs in IP
packets, and assumes that there is other security protecting tunnels to
a host. It would be more appropriate to cite IPsec as IP security, and
GTSM as "other protection mechanisms".

Other work in this area:
	- draft-ietf-tcpm-antispoof (as noted above)
	- draft-ietf-tcpm-tcpsecure
	- draft-bellovin-tcpsposition: attachment; filename="signature.asc"

--------------enigCD0E0DBCDB6BA044BC9AE154--

--=======17995109=
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

--=======17995109=--

---

From: "Barry Greene \(bgreene\)" <[email-masked]>
Date: Fri, 22 Jun 2007 06:31:13 -0700

I guess we have differing views on the definition of "security." If I
can classify based on a policy which provides me more resistance from
attacks, then that is a "security tool." Hence, GTSM is a security tool.

> -----Original Message-----
> From: Joe Touch [mailto:[email-masked]] 
> Sent: Thursday, June 21, 2007 1:34 PM
> To: [email-masked]
> Subject: [RPSEC] Feedback on draft-behringer-bgp-session-req-01
> 
> Hi, all,
> 
> The following feedback was requested on the TCPM's 
> TCP-AUTH-DT (TCP-Auth design team) mailing list. TCP-Auth is 
> TCMP's work towards an update to TCP-MD5, based on two 
> current proposals (noted below).
> 
> Joe
> 
> This document appears to overlap ongoing work in TCPM to 
> characterize concerns with using TCP-MD5 to secure BGP, and 
> use of alternatives.
> E.g., draft-ietf-tcpm-antispoof. The TCP-Auth team is 
> currently workiing to revise draft-bellovin-tcpsec, and an 
> update to that should be out shortly.
> 
> GTSM is not IP layer security; it is a heuristic that checks 
> TTLs in IP packets, and assumes that there is other security 
> protecting tunnels to a host. It would be more appropriate to 
> cite IPsec as IP security, and GTSM as "other protection mechanisms".
> 
> Other work in this area:
> 	- draft-bellovin-tcpsec
> as well as specific proposals to update TCP-MD5:
> 	- draft-touch-tcpm-tcp-simple-auth
> 	- draft-bonica-tcp-auth
> 
> Further, to a large extent, the preference of router managers 
> to avoid IPsec was the motivation behind BTNS:
> 	- http://www.ietf.org/html.charters/btns-charter.html
> See also the problem and applicability statement:
> 	- draft-ietf-btns-prob-and-applic
> 
> draft-bellovin-tcpsec should be cited in "Dependence on the 
> MD5 algorithm...", as well as RFC4808
> 
> 3.2 - IPsec = RFC4301
> in addition to Bonica's proposed alternative, please include 
> mine   ;-)   :
> draft-touch-tcpm-tcp-simple-auth
> 
> 3.3 - "This requirement is currently..." - also by IPsec.
> 
> --
> ----------------------------------------
> Joe Touch
> Sr. Network Engineer, USAF TSAT Space Segment
> 
>

---

From: Joe Touch <[email-masked]>
Date: Fri, 22 Jun 2007 07:21:17 -0700

Hi, Barry,

> attacks, then that is a "security tool." Hence, GTSM is a security tool.

GTSM could be classified as a security tool, but it is not IP layer
security. It is a mechanism an endpoint can use to increase its
resistance to attack, as you note, but it doesn't particularly protect
any single protocol layer or header.

Joe

---

From: Stephen Kent <[email-masked]>
Date: Fri, 22 Jun 2007 11:10:40 -0400

At 7:21 AM -0700 6/22/07, Joe Touch wrote:
>Content-Type: multipart/signed; micalg=pgp-sha1;
>	protocol="application/pgp-signature";
>	boundary="------------enigB1D3AB5BCF55D129E9BDB950"
>
>Hi, Barry,
>

GTSM also has a very limited (although important) scope, since it is 
generally applicable only in contexts where one can predict the 
appropriate TTL value for legitimate traffic (and where active 
attacks on the path the traffic is traversing are not assumed to be 
viable).

Steve

---

From: Ron Bonica <[email-masked]>
Date: Fri, 22 Jun 2007 13:02:12 -0400

Folks,

I think that the following word might be useful as we discuss the proper
classification of GTSM within the taxonomy of security mechanisms:

http://www.worldwidewords.org/weirdwords/ww-tet1.htm

                              all in good fun ;-)
                                  Ron

Stephen Kent wrote:
> appropriate TTL value for legitimate traffic (and where active attacks
> on the path the traffic is traversing are not assumed to be viable).
> 
> Steve
> 
>