Last Call Review of draft-ietf-pce-pcep-extension-for-pce-controller-10
review-ietf-pce-pcep-extension-for-pce-controller-10-secdir-lc-sheffer-2021-02-06-00

Request Review of draft-ietf-pce-pcep-extension-for-pce-controller
Requested rev. no specific revision (document currently at 12)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2021-02-08
Requested 2021-01-25
Authors Zhenbin Li, Shuping Peng, Mahendra Negi, Quintin Zhao, Chao Zhou
Draft last updated 2021-02-06
Completed reviews Rtgdir Last Call review of -09 by Victoria Pritchard (diff)
Genart Last Call review of -11 by Gyan Mishra (diff)
Secdir Last Call review of -10 by Yaron Sheffer (diff)
Secdir Telechat review of -12 by Yaron Sheffer
Assignment Reviewer Yaron Sheffer 
State Completed
Review review-ietf-pce-pcep-extension-for-pce-controller-10-secdir-lc-sheffer-2021-02-06
Posted at https://mailarchive.ietf.org/arch/msg/secdir/HwOlHVfUaxXV-by1zubTTxLl_Fw
Reviewed rev. 10 (document currently at 12)
Review result Not Ready
Review completed: 2021-02-06

Review
review-ietf-pce-pcep-extension-for-pce-controller-10-secdir-lc-sheffer-2021-02-06

This document defines PCEP extensions for the RFC 8283 architecture, where the PCE acts as a central controller in an SDN. The document is focused on specific use cases, referred to as "basic PCECC mode".

Let me state up front that I am not familiar with the PCE architecture other than what I read up in order to review this document. Having said that, I suspect that there would be significant value in a security analysis of the architecture defined here. Having each connection "authenticated and encrypted" is table stakes nowadays, but is it really enough for very large SDN deployments that require this level of protocol sophistication?

Details

9.1: "authenticated and encrypted" TLS sessions are typically only authenticated by the server. Please point out explicitly that mutual authentication is required. Also, is there no authorization? I would assume a peer PCE Controller is allowed to do different things than a PCC. Are all PCCs allowed to issue the same commands/queries, targeted at the same resources?

- RFC 8283 which defines the architecture that is implemented by this draft says:

[The] security implications of SDN have not been fully discussed or described.  Therefore, protocol and applicability work-around solutions for this architecture must take proper account of these concerns.

It is expected that each new document that is produced for a specific use case will also include considerations of the security impacts of the use of a PCE-based central controller on the network type and services being managed.

I don't think that the current document addresses this challenge.

In general, this looks like a very monolithic architecture, where everybody trusts everybody else once they've been authenticated. Although Sec. 9.1 discusses the case of a malicious PCE (which would be rather catastrophic), I would encourage the authors to consider whether a malicious PCC can also disrupt the PCE's operations and cause "major impact to the network".