[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[lisp] Please read draft-bagnulo-lisp-threat-01.txt



Luigi's security draft contained a reference to Marcelo's earlier
threat analysis which I at least had never run across.  It's excellent
work and I'd strongly encourage everyone in the WG to read it.

Stylistically it does a good job of motiving the attack and providing enough detail to explain why the attack is realistic/when the attack is realistic. 

The draft is somewhat dated.  It analyzes LISP 1 (routable EIDs) not
LISP 1.5 (what we're doing, I think).  Also, several of the attacks
described there have been fixed.  For example, we have much stronger
wording about the problems of gleaning and I think we may even have a
consensus that data gleaning is inappropriate for Internet contexts.

Also, some of the details have changed.

However some of the attacks described seem alive and well against
current LISP and definitely seem like the sorts of things we'll need
to fix.  So, between be an excellent example of how to go about this
sort of analysis and containing still-important information for
today's LISP, I think it is well worth the read if you have not done
so.  However, before drawing conclusions, make sure they are still
accurate for the LISP of 2009 instead of the LISP of 2007.

Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.