[secdir] Secdir review of draft-ietf-softwire-gateway-init-ds-lite

Tobias Gondrom <tobias.gondrom@gondrom.org> Wed, 04 January 2012 13:00 UTC

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=gondrom.org; b=fj1qibpSU75/00Jf85dpgiksn/SYul/imUQQ6U96Hb35H5lsG15WJLXrUgaDQZF21XKqRFbo21SRPfPzmCTMheO25hABvcUKo/+wx8MoS/U5N/EDjFdiSE9VEyVELfQp; h=Received:Received:Message-ID:Disposition-Notification-To:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type;
Message-ID: <4F044D50.7090709@gondrom.org>
Date: Wed, 04 Jan 2012 13:00:00 +0000
From: Tobias Gondrom <tobias.gondrom@gondrom.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111220 Thunderbird/9.0
MIME-Version: 1.0
To: draft-ietf-softwire-gateway-init-ds-lite.all@tools.ietf.org, secdir@ietf.org, iesg@ietf.org
Content-Type: multipart/alternative; boundary="------------090104030409090802010707"
Subject: [secdir] Secdir review of draft-ietf-softwire-gateway-init-ds-lite
Precedence: list

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

The Security Considerations of this document refer to four other 
documents. Unfortunately it does not state whether any new security 
issues are introduced by GI-DS-lite (or claims that no additional 
security issues are introduced by this spec).

A few security questions come to mind reading the spec:
- is there an implication that it is allowed to establish the softwire 
between Gateway and AFTR at any point in time (not just startup)?
- does the required uniqueness of combination of CID and SWID result in 
any attack vectors?
(btw. in section 3 do you mean "The combination of CID and SWID must be 
unique between gateway and AFTR" or "The combination of CID and SWID 
MUST be unique between gateway and AFTR"
- to define that the translation scheme configuration will be done 
either manually or out-of-band seems to solve some security worries, 
however, does this imply these MUST be done manually or out-of-band 
(e.g. for security purposes)?

COMMENT/DISCUSS:
I am concerned about the weak or possibly not proper use of RFC2119 
wording in wide parts of the drafts. In several cases I would expect 
RFC-2119 language instead of the currently used can/may/must (e.g. take 
a read of section 4 and 5).

typos:
Section 1:
s/GRE based encapsulation mechanisms is chosen/a GRE based encapsulation 
mechanism is chosen

Best regards, Tobias

[secdir] Secdir review of draft-ietf-softwire-gat… Tobias Gondrom