Last Call Review of draft-ietf-nsis-rmd-

Request Review of draft-ietf-nsis-rmd
Requested rev. no specific revision (document currently at 20)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2010-04-20
Requested 2010-03-03
Authors Cornelia Kappler, Lars Westberg, Thomas Phelan, Georgios Karagiannis, Attila Bader
Draft last updated 2010-04-19
Completed reviews Secdir Last Call review of -?? by Brian Weis
Assignment Reviewer Brian Weis
State Completed
Review review-ietf-nsis-rmd-secdir-lc-weis-2010-04-19
Review completed: 2010-04-19


I have reviewed this document as part of the security directorate's  

ongoing effort to review all IETF documents being processed by the  

IESG. These comments were written primarily for the benefit of the  

security area directors. Document editors and WG chairs should treat  

these comments just like any other last call comments.

This document describes an NSIS QoS Model for networks that use the  

Resource Management in Diffserv (RMD) concept. It describes RMD-QOSM,  

which are new payloads sent using the GISP signaling mechanism, where  

the new payloads request or reserve resources. A number of data flows  

are discussed, depending on whether nodes within a network boundary  

participate in the protocol or not.

The Security Considerations section covers the following topics:

- Byzantine adversaries (i.e., participants taken over by an  

adversary) are a general problem, but this section intends to discuss  

additional threats as a result of the new protocol. There is an  

extensive discussion of on-path and off-path adversaries, which seems  

to intend to be addressing Byzantine adversaries.

- RMD-QOSM is claimed to be lightweight, with different routers  

allowed certain operations dependant on the role a router plays in the  

system. E.g., only Ingress/Egress nodes are allowed to initiate  

certain signaling messages.

- RMD-QOSM "relies on the security support that is provided by the  

bounded end-to-end session, which is running between the boundaries of  

the RMD domain", but doesn't mandate that security support.

The existing text is helpful, but not sufficient. The following points  

are suggestions to improve this section.

1. The statement at the beginning of Security Considerations discusses  

adversaries taking over a router, but the new threats are not very  

clear. Are the authors considering that security associations are  

revealed, that reservation data routed to a particular router can be  

changed or forged, or something else?

2. The trust model used by RMD-QOSM is hinted at in the discussion of  

on-path and off-path adversaries, but a discussion of exactly what  

devices are trusted and what they're trusted to do would be helpful.  

For example, is every interior router in the network is trusted to  

handle any particular RESERVE or RESERVE` message? If not, then how  

are the paths setup so that only authorized routers will see a  

particular message? On the other hand, if routing is used to route the  

messages then it would seem that any router must be authorized to  

handle messages happened to be routed to them -- but then it isn't  

clear that there can be a difference between an "on-path" and "off- 

path" adversary.

3. Another dimension of trust model is the fact that ingress/egress  

routers seem to trust each other more than they trust interior nodes.  

This seems evidenced by the fact that RESERVE messages (Figure 24)  

don't seem to be intended to be modified by the interior routers. In  

the case of probes, I would expect that this would be especially  

important, but probes do not seem to be specifically discussed in this  


4. There don't seem to be any actual security requirements or  

recommendations made on GIST messaging. As such, it isn't clear that  

attackers that have not taken over a participant (i.e., a man in the  

middle) are in any way foiled. I would expect to see more MUSTs and   

SHOULDs in this section regarding message security.  There are  

statements in the I-D such as "In the situation a security association  

exists" and "If we assume that the RESERVE/RESPONSE is sent with hop- 

by-hop channel security". There should be some description of the  

threats to the messaging by a non-participant, and stating what  

available mechanisms MUST or SHOULD be used.

5. Since roles seem to be an important part of the security  

considerations, it would be helpful to see  discussion of the  

different threats & requirements on the ingress/egress routers and the  

internal routers in their different roles.

6. An important service of RMD-QOSM is admission control, but there  

doesn't seem to be any discussion of how the ingress routers determine  

whether or not reservation requests given to them are valid. I would  

have thought that is of particular importance, but if it's considered  

out of scope this section might mention that fact.

Hope that helps,