Re: [MEXT] Review of draft-ietf-mext-binding-revocation-03.txt

[Sri Gundavelli <sgundave at cisco.com>]

Hi Vijay,

Some comments on this.


> > Does the LMA keep a list of MAGs that are authorized for
> > sending bulk revocations? How is this list configured? In
> > addition, I think this authorization step is unnecessary and
> > should be removed.

Bulk revoc is a high security risk operation, requiring such
authorization check will allow the system to build some
configurability into the system.

Even for a single binding, if you recall and as Ahmad pointed
out, we do require this in 5213. We added this per IESG note.
Before the MAG can create a binding, the LMA is required to check
if the given MAG is authorized to perform such an operation. The
same goes for dereg, its enforced indirectly, there is a check
for binding's Proxy-CoA to match the PBU's Proxy-CoA, before the
dereg is allowed.

Now, this check for bulk dereg spanning many MN's is for the
specific operation, if its allowed or not. This is a requirement
for a good system design, from OM perspective. Has no bearing
on protocol interop. I dont think this can be an issue, one
can always add a * rule to permit every MAG to perform such
operation.

If your concern is maintaing that list, we can always state in
a secure network, the MAG can just have one flat rule to allow
such operation from all the configured peers that it knows.
Will that work ?


Sri