Subject: [RPSEC] Feedback on draft-behringer-bgp-session-req-01

From: Joe Touch <[email-masked]>
Date: Thu, 21 Jun 2007 13:33:57 -0700

Hi, all,

The following feedback was requested on the TCPM's TCP-AUTH-DT (TCP-Auth
design team) mailing list. TCP-Auth is TCMP's work towards an update to
TCP-MD5, based on two current proposals (noted below).

Joe

---------------------------------------------

This document appears to overlap ongoing work in TCPM to characterize
concerns with using TCP-MD5 to secure BGP, and use of alternatives.
E.g., draft-ietf-tcpm-antispoof. The TCP-Auth team is currently workiing
to revise draft-bellovin-tcpsec, and an update to that should be out
shortly.

Some additional comments:

Sec 1 - the OSI stack is not the reference model for the Internet.
GTSM is not IP layer security; it is a heuristic that checks TTLs in IP
packets, and assumes that there is other security protecting tunnels to
a host. It would be more appropriate to cite IPsec as IP security, and
GTSM as "other protection mechanisms".

Other work in this area:
	- draft-ietf-tcpm-antispoof (as noted above)
	- draft-ietf-tcpm-tcpsecure
	- draft-bellovin-tcpsec
as well as specific proposals to update TCP-MD5:
	- draft-touch-tcpm-tcp-simple-auth
	- draft-bonica-tcp-auth

Further, to a large extent, the preference of router managers to avoid
IPsec was the motivation behind BTNS:
	- http://www.ietf.org/html.charters/btns-charter.html
See also the problem and applicability statement:
	- draft-ietf-btns-prob-and-applic

draft-bellovin-tcpsec should be cited in "Dependence on the MD5
algorithm...", as well as RFC4808

3.2 - IPsec = RFC4301
in addition to Bonica's proposed alternative, please include mine   ;-)   :
draft-touch-tcpm-tcp-simple-auth

3.3 - "This requirement is currently..." - also by IPsec.

-- 
----------------------------------------
Joe Touch
Sr. Network Engineer, USAF TSAT Space Segment

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec