Re: [RPSEC] Last Call For draft-ietf-rpsec-bgpsecrec-10.txt

[Joe Touch <touch at ISI.EDU>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Russ White wrote:
> Folks:
> 
> This draft has been around a long long time, and has been subject to a
> great deal of discussion. I would like to start a two week last call on
> this one, at the end of which we'll forward this to the ADs for final
> preparations for publication.
> 
> Please post any comments to the list.

Hi, all,

I have feedback dating back to June 2007 which remains unaddressed. I
repeat it here, as well as adding additional comment from the current
version.

Joe

- --------------------------
- From June 2007:

Abstract - I disagree that securing the info between the parties is an
easy technical matter; if it were, transport or network would be in more
regular use.

This document should note explicitly (e.g., in the abstract or at latest
in Sec 2.3) that network and transport security are not addressed in
this document.

- ---------------------------

This document really should have a section that addresses the
relationship of BGP security to transport and network security. It would
 be useful to point out that BGP interprets transport reachability as
routing reachability - and that this decision renders it particularly
vulnerable to attacks that interrupt the transport layer. This implies
that BGP SHOULD protect its TCP connection, e.g., via IPsec or TCP-AO.

This section should also state that some other issues noted throughout
this document - e.g., DDOS overload protection, processing
considerations, buffering considerations, router configuration,
initialization, key management, etc. - apply to the TCP protection as
well as BGP.

- ---------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkkkdSYACgkQE5f5cImnZrvnGACg03oNtBWZFvFolnSU1n0yhWsm
LpEAn3agN6KgXnI8mGTqe6KTrsKI7+Rh
=7JL6
-----END PGP SIGNATURE-----
_______________________________________________
RPSEC mailing list
RPSEC at ietf.org
https://www.ietf.org/mailman/listinfo/rpsec