Re: [secdir] draft-ietf-nvo3-use-case-15 SECDIR review

Donald Eastlake <d3e3e3@gmail.com> Wed, 04 January 2017 03:50 UTC

MIME-Version: 1.0
In-Reply-To: <2691CE0099834E4A9C5044EEC662BB9D57B9C24B@dfweml501-mbb>
References: <CAF4+nEGUcm7h6VUUa-Bsx3c8XnXZvu5Tf5-Oeu5ELsCn6sogYw@mail.gmail.com> <2691CE0099834E4A9C5044EEC662BB9D57B9C24B@dfweml501-mbb>
From: Donald Eastlake <d3e3e3@gmail.com>
Date: Tue, 03 Jan 2017 22:49:52 -0500
Message-ID: <CAF4+nEH5dUDHanKK56wTVeMidx3Loi5Xs8DD_ayV4XqOZHpq9Q@mail.gmail.com>
To: Lucy yong <lucy.yong@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/zJRiGB_rVxjEa-guL0E_VwhPjzY>
Cc: "draft-ietf-nvo3-use-case.all@ietf.org" <draft-ietf-nvo3-use-case.all@ietf.org>, "iesg@ietf.org" <iesg@ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] draft-ietf-nvo3-use-case-15 SECDIR review
Precedence: list

Hi Lucy,

On Tue, Jan 3, 2017 at 3:48 PM, Lucy yong <lucy.yong@huawei.com> wrote:
> Hi Donald,
>
>
> Thank you for the review.
>
>
> From: Donald Eastlake [mailto:d3e3e3@gmail.com]
> Sent: Tuesday, January 03, 2017 10:15 AM
> To: iesg@ietf.org; draft-ietf-nvo3-use-case.all@ietf.org
> Cc: secdir@ietf.org
> Subject: draft-ietf-nvo3-use-case-15 SECDIR review
>
>
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG. Document
> editors and WG chairs should treat these comments just like any other last
> call comments.
>
>
> This draft described use cases for network virtualization overlay networks
> focusing on Data Center use. I think this document is Ready with issues.
>
>
> Security:
>
>
> As an Informational use case document, security is not a major focus of this
> draft. Nevertheless:
>
>
> The existing Security Considerations section says that Data Center operators
> need to provide tenants with a virtual network that is "isolated from other
> tenants' traffic as well as from underlay networks". But I don't think
> tenants can, in general, be protected from the underlay network. I would say
> that tenants are vulnerable to observation and data modification/injection
> by the operator of the underlay and should only use operators they trust.
>
> [Lucy] How about: DC operators need to provide a tenant with a secured
> virtual network, which means one tenant’s traffic is isolated from other
> tenants’ traffic and is not leaked to the underlay networks. Tenants are
> vulnerable to observation and data modification/injection by the operator of
> the underlay and should only use operators they trust.

OK.

> The existing Security Considerations section says that tenants need to be
> isolated from each other but I believe there will always be covert channels,
> based on resource contention and the like, by which tenants can communicate
> with each other and the best that can be done is to limit the bandwidth of
> such communications.
>
> [Lucy] suggested text is taken.

OK.

> Minor:
>
> "BUM" and "ASBR" used without definition or expansion.
>
> [Lucy] ack. Fix some others too.

OK.

> Wording: I think the wording is off in some places for a reader for whom
> English is their native language. See attached for suggestions. I probably
> haven't caught all the wording glitches.
>
> [Lucy] thank very much for the correction.  Should I upload the updated
> version or wait the feedback from other areas?

I would say that you should not update the draft while the IETF Last
Call is running. So you should at least wait until after January 11th.
And in general, after that, you should check with the document
Shepherd (Matthew Bocci) or the AD (Alia Atlas).

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 d3e3e3@gmail.com

> Thanks,
>
> Lucy
>
>
>
> Thanks,
> Donald
> ===============================
>  Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
>  155 Beaver Street, Milford, MA 01757 USA
>  d3e3e3@gmail.com

[secdir] draft-ietf-nvo3-use-case-15 SECDIR review Donald Eastlake
Re: [secdir] draft-ietf-nvo3-use-case-15 SECDIR r… Lucy yong
Re: [secdir] draft-ietf-nvo3-use-case-15 SECDIR r… Donald Eastlake