search

mglt / draft-mglt-nvo3-geneve-security-requirements

0 stars 1 forks source link

requirement expression #5

Open mglt opened 5 years ago

mglt commented 5 years ago
  1. Section 2: Paragraph beginning with SEC-OP: We need a single set of requirements with MUST/SHOULD/MAY and not separate requirements into what is needed to “evaluate a given deployment”. I do not agree with the statement “On the other hand … to secure any Geneve deployment” – it assumes that there should be a Geneve specific security mechanism, which is not the case with other tunneling schemes – where they work with other parts of the stack to realize security.
mglt commented 5 years ago

I believe that there is a misunderstanding here. SEC-OP and SEC-GEN designates a category of security requirements. The security requirements is listed later in the document. The category does not lead to MUST/SHOULD/MAY statement.

SEC-OP are intended to an operator to check whether its deployment is secured or not. This category has been added in this version. The category has been added as this has been requested.

SEC-GEN defines the security requirements that a future Geneve security mechanism needs to fulfill, in order to secure any Geneve deployment that respect the Geneve architecture. The mechanism has not been yet defined. There is no assumption that a new mechanism needs to be designed. The design of such mechanism is expect to re-use existing mechanisms. In this case all requirements will need to be fulfilled in order to be considered as a Geneve security mechanism.

I think that the document clearly states that there is no such assumption and that the design of new mechanism should be avoided as much as possible.

""" Such mechanism may require the design of a specific solution. In the case new protocol needs to be design, the document strongly recommend to re-use existing security protocols like IP Security (IPsec) [RFC4301] and Datagram Transport Layer Security (DTLS) [RFC6347], and existing encryption algorithms (such as [RFC8221]), and authentication protocols. """

Do we agree that this concern is addressed by the current draft ?