Subject: [secdir] Secdir review of draft-ietf-multi-cost

From: Magnus Nyström <[email-masked]>
Date: Sun, 26 Mar 2017 20:50:39 -0700

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. These comments were written primarily for the benefit of the
security area directors. Document editors and WG chairs should treat
these comments just like any other last call comments.

This document describes extensions to the ALTO (Application Layer
Traffic Optimization) protocol that allows for more efficient
information exchanges between an ALTO client and an ALTO server.
Specifically, it allows a client to query for multiple metrics in one
request.

The security considerations section correctly refers to the basic ALTO
protocol I only have one additional consideration (and I don't even
know if it applies ...): With the existing ALTO protocol, a server
could defend against dDOS by not throttling requests. However, each
accepted request is simple in that it only deals with one metric. With
this document, a malicious client could send a highly complicated
query to the server, which may cause significant resources to be used
on the server end and without an ability to throttle. Is that a risk?

Other than that, the document may benefit from a language/grammar
review. Example:
"Hence a legacy may send a request with a constraint test on any of
the cost types listed in "cost-type-name" - should likely be "legacy
client". There are more such examples.

Thanks,
-- Magnus

---

From: "Randriamasy, Sabine (Nokia - FR/Nozay)" <[email-masked]>
Date: Mon, 27 Mar 2017 23:36:01 +0000

Hello Magnus,

Thank you very much for your review and feedback. To answer your questions:
- we believe that this proposal does not cause any additional security issues compared to the base protocol specified in RFC7285. The Multi-Cost optimization even tends to reduce the  on the wire data exchange volume compared to multiple single cost ALTO transactions. Likewise, the risk related to massive multi-cost request is moderated by the fact that Multi-Cost constraints further filters ALTO Server responses and thus their volume. 
- Indeed the formulation "legacy" needs be updated as you suggest. We will track similar examples and post a revision. 

Best regards,
Sabine

>>-----Original Message-----
>>From: Magnus Nyström [mailto:[email-masked]]
>>Sent: lundi 27 mars 2017 05:51
>>To: [email-masked]; [email-masked]
>>Subject: Secdir review of draft-ietf-multi-cost
>>
>>I have reviewed this document as part of the security directorate's ongoing
>>effort to review all IETF documents being processed by the IESG. These
>>comments were written primarily for the benefit of the security area
>>directors. Document editors and WG chairs should treat these comments just
>>like any other last call comments.
>>
>>This document describes extensions to the ALTO (Application Layer Traffic
>>Optimization) protocol that allows for more efficient information exchanges
>>between an ALTO client and an ALTO server.
>>Specifically, it allows a client to query for multiple metrics in one request.
>>
>>protocol I only have one additional consideration (and I don't even know if it
>>applies ...): With the existing ALTO protocol, a server could defend against
>>dDOS by not throttling requests. However, each accepted request is simple
>>in that it only deals with one metric. With this document, a malicious client
>>could send a highly complicated query to the server, which may cause
>>significant resources to be used on the server end and without an ability to
>>throttle. Is that a risk?
>>
>>"Hence a legacy may send a request with a constraint test on any of the cost
>>types listed in "cost-type-name" - should likely be "legacy client". There are
>>more such examples.
>>
>>Thanks,
>>-- Magnus