I dropped the distribution to just the IESG for this response... On 10/13/15 10:06 PM, Kathleen Moriarty wrote: > Kathleen Moriarty has entered the following ballot position for > draft-ietf-grow-bmp-15: Discuss > > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this > introductory paragraph, however.) > > > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. > > > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-grow-bmp/ > > > > ---------------------------------------------------------------------- > DISCUSS: > ---------------------------------------------------------------------- > > The statements on authenticated access and confidentiality are helpful, > but this is a new protocol and should not start out with the security > property levels of the current BGP deployments. Efforts have been made > to publish RFCs to fix BGP security and the vulnerabilities have been > published - even in the Washington Post. I'd like to see more security > required for the properties mentioned to prevent active and passive > attacks getting dumps of the BGP data, which was not previously > available. If this is not possible per the suggestions below, please > explain why. If there is a good reason, it would be helpful to remove > the text that says its okay to leave security out because BGP isn't > secure and just include the security considerations. > > Now for specifics: > > 1. In the Security considerations, it is not only a passive attacker, but > also an active one that could gain access to the session if it is not > encrypted (protected for confidentiality). An active attacker might > change routes causing network disruption. A passive attacker might > better understand the possible paths to an AS, assisting with a more > effective DDoS attack. The latter point is important to consider in the > first paragraph of this section that currently says, > "although it's hard to consider the content of BGP routes in the > public Internet to be confidential," > > I think this is a bit of an overstatement as the exact routes and paths > are not published for each router and could be used for DoS attacks - for > example taking out one or more paths to a network AS. > > What I am suggesting for #1 is a simple text change to address the fuller > set of security considerations. > Change from: > Unless a transport that provides confidentiality is used, > a passive attacker could gain access to BMP data in flight. > To: > Unless a transport that provides confidentiality is used, > a passive or active attacker could gain access to or tamper the BMP > data in flight. >
Tampering with BMP data will not impact the BGP routing infrastructure. BMP does not have the ability to modify the BGP routes processed by a router. It is designed to mirror information to a collector so that the collector does not have to use archaic techniques like screen scraping to monitor BGP behavior. An active attack that tampers with the BMP data will simply make services like BGP mirrors show incorrect data and not actually influence BGP routing operation. Regards, Brian
signature.asc
Description: OpenPGP digital signature
_______________________________________________ GROW mailing list [email protected] https://www.ietf.org/mailman/listinfo/grow
