IGP extension for PCEP security capability support in the PCE discovery
draft-ietf-lsr-pce-discovery-security-support-02
PCE working group D. Lopez
Internet-Draft Telefonica I+D
Updates: 5088,5089 (if approved) Q. Wu
Intended status: Standards Track D. Dhody
Expires: March 5, 2020 Z. Wang
Huawei
D. King
Old Dog Consulting
September 2, 2019
IGP extension for PCEP security capability support in the PCE discovery
draft-ietf-lsr-pce-discovery-security-support-02
Abstract
When a Path Computation Element (PCE) is a Label Switching Router
(LSR) participating in the Interior Gateway Protocol (IGP), or even a
server participating in IGP, its presence and path computation
capabilities can be advertised using IGP flooding. The IGP
extensions for PCE discovery (RFC 5088 and RFC 5089) define a method
to advertise path computation capabilities using IGP flooding for
OSPF and IS-IS respectively. However these specifications lack a
method to advertise PCEP security (e.g., Transport Layer
Security(TLS), TCP Authentication Option (TCP-AO)) support
capability.
This document proposes new capability flag bits for PCE-CAP-FLAGS
sub-TLV that can be announced as attribute in the IGP advertisement
to distribute PCEP security support information. In addition, this
document updates RFC 5088 and RFC 5089 to allow advertisement of Key
ID or Key Chain Name Sub-TLV to support TCP AO security capability.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
Lopez, et al. Expires March 5, 2020 [Page 1]
Internet-Draft IGP discovery for PCEP Security September 2019
This Internet-Draft will expire on March 5, 2020.
Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
1. Introduction
As described in [RFC5440], PCEP communication privacy is one
importance issue, as an attacker that intercepts a Path Computation
Element (PCE) message could obtain sensitive information related to
computed paths and resources.
Among the possible solutions mentioned in these documents, Transport
Layer Security (TLS) [RFC8446] provides support for peer
authentication, and message encryption and integrity while TCP
Authentication Option (TCP-AO) [RFC5925] and Cryptographic Algorithms
for TCP-AO [RFC5926] offer significantly improved security for
applications using TCP. As specified in section 4 of [RFC8253], in
order for a Path Computation Client (PCC) to begin a connection with
a PCE server using TLS or TCP-AO, PCC needs to know whether PCE
server supports TLS or TCP-AO as a secure transport.
[RFC5088] and [RFC5089] define a method to advertise path computation
capabilities using IGP flooding for OSPF and IS-IS respectively.
However these specifications lack a method to advertise PCEP security
(e.g., TLS) support capability.
This document proposes new capability flag bits for PCE-CAP-FLAGS
sub-TLV that can be announced as attributes in the IGP advertisement
to distribute PCEP security support information. In addition, this
document updates RFC5088 and RFC5089 to allow advertisement of Key ID
or Key Chain Name Sub-TLV to support TCP AO security capability.
Note that the PCEP Open message exchange is another way to discover
PCE capabilities information, but in this instance, the TCP security
related key parameters need to be known before the PCEP session is
Show full document text