Subject: [babel] Roman Danyliw's Discuss on draft-ietf-babel-dtls-07: (with DISCUSS and COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Wed, 07 Aug 2019 12:26:04 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-babel-dtls-07: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-babel-dtls/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

(1) Section 1. These are different than the ones listed in Section 6 of
draft-ietf-babel-rfc6126bis and Section 1 of draft-ietf-babel-dtls.  As DTLS
and HMAC are mitigations for attacks in draft-ietf-babel-rfc6126bis, they
really should be harmonized.

(2) Section 2.1.  Per “Implementations MUST support authenticating peers
against a local store of credentials”, what does that credentialing look like? 
Is it certificates, PSK, etc?  What validation procedure is being used for this
authentication?

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

(3) Abstract.  Per “Babel does not contain any means … [to] protect messages”,
be more precise in the definition of protect (i.e., integrity and
confidentiality)

(4) Section 1.2.  Per “A comparison of Babel security mechanisms and their
applicability can be found in [RFC6126bis]”, where in
draft-ietf-babel-rfc6126bis does this comparison occur.  The references to HMAC
and TLS are in a single paragraph in in Section 6/Security Considerations which
roughly reiterate the one sentence statements written here.

(5) Section 2.1.  Per “When a node receives a new DTLS connection, it MUST
verify that the source IP address is an IPv6 link-local address …”, what
happens if IPv4 is in use?

(6) Section 2.1. Per “Nodes MUST only negotiate DTLS version 1.2 or higher”,
this is stricter than RFC7525 cited in the Security Consideration later in the
draft.  That’s fine, but please reiterate that in Section 5.

(7) Section 2.6  Suggest being clearer that this is a deployment not an
implementation issue. s/Implementations MAY implement both Babel over DTLS and
unprotected Babel./ /A node MAY run both Babel over DTLS and unprotected Babel./

(8) Section 2.6, Per “However, accepting unprotected Babel packets … loses the
security properties of Babel over DTLS”.  This seems misleading.  The security
properties of “Babel over DTLS” as a protocol are stated in Section 1.2.  In
this section there is discussion of the security properties of the node (and
the resulting neighbor table).  These are different.  The issue seems to be
that a node is building a neighbor table with updates from sources which need
to be trusted to different degrees.

(9) Section 5.  Per “Confidential interaction between two Babel peers requires
Datagram Transport Layer Security (DTLS) with a cipher suite offering 
confidentiality protection.  The guidance given in [RFC7525] MUST be followed
to avoid attacks on DTLS.”, the first sentence is true, but incomplete, in that
we’d also want cipher suites with a strong key exchange algorithm, etc. 
Section 4.2 of RFC7525, which is cited as a MUST, provides a list of
recommended ciphers suites.  Do we need this first sentence?

(10) Editorial
-- Section 2.1.  Expand “IHU” on first use

-- Section 3.  Nit. s/ciphers/ciphersuites/

---

From: David Schinazi <[email-masked]>
Date: Thu, 8 Aug 2019 17:44:29 -0700

Thanks for your review Roman! We've made changes on our git repository
<https://github.com/jech/babel-drafts> and will submit a revised draft
shortly.

Detailed responses inline.

Thanks,
David

We've fleshed out the text in draft-ietf-babel-rfc6126bis and kept the
reference
in draft-ietf-babel-dtls.

> Is it certificates, PSK, etc?  What validation procedure is being used for

I'll respond to this point on Ben's DISCUSS since I think you're both asking
for the same thing.

Agreed, fixed.

> roughly reiterate the one sentence statements written here.

We've fleshed out the text in draft-ietf-babel-rfc6126bis and kept the
reference
in draft-ietf-babel-dtls.

> happens if IPv4 is in use?

This was an oversight. The text now also discusses IPv4.

> draft.  That’s fine, but please reiterate that in Section 5.

Done.

> unprotected Babel./ /A node MAY run both Babel over DTLS and unprotected

Agreed. We added your new sentence but also kept the old one since both are
true.

> to be trusted to different degrees.

Agreed. We've reworked that paragraph.

> recommended ciphers suites.  Do we need this first sentence?

Fair enough, We've removed that sentence.

(10) Editorial
> -- Section 2.1.  Expand “IHU” on first use

Done

Done

---

From: David Schinazi <[email-masked]>
Date: Fri, 9 Aug 2019 16:40:02 -0700

We've now submitted -08 which contains the changes discussed below.

Thanks,
David

On Thu, Aug 8, 2019 at 5:44 PM David Schinazi <[email-masked]>
wrote:

> Agreed. We added your new sentence but also kept the old one since both
> are true.
>
>

---

From: Roman Danyliw <[email-masked]>
Date: Mon, 12 Aug 2019 23:35:18 +0000

Hi David!

From: David Schinazi [mailto:[email-masked]]
Sent: Friday, August 9, 2019 7:40 PM
To: Roman Danyliw <[email-masked]>
Cc: The IESG <[email-masked]>; [email-masked]; Donald Eastlake <[email-masked]>; babel-chairs <[email-masked]>; Babel at IETF <[email-masked]>
Subject: Re: Roman Danyliw's Discuss on draft-ietf-babel-dtls-07: (with DISCUSS and COMMENT)

Thanks,
David

On Thu, Aug 8, 2019 at 5:44 PM David Schinazi <[email-masked]<mailto:[email-masked]>> wrote:
Thanks for your review Roman! We've made changes on our git repository
<https://github.com/jech/babel-drafts> and will submit a revised draft shortly.

Thanks,
David

On Wed, Aug 7, 2019 at 12:26 PM Roman Danyliw via Datatracker <[email-masked]<mailto:[email-masked]>> wrote:
----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

We've fleshed out the text in draft-ietf-babel-rfc6126bis and kept the reference
in draft-ietf-babel-dtls.

[Roman] Concur that Ben and I are raising the same concern.  I appreciate the explanation you provided in:

https://mailarchive.ietf.org/arch/msg/babel/HuoEG7HG_rSfs3rCFZo2ZYdCl_I

Ben’s recommendation to explicitly note that this authentication needs to be solved in external profiles would address my concern too:

https://mailarchive.ietf.org/arch/msg/babel/5AnLlaHPTEsBJpV7WVrZLpw07ls

(I don’t know if you were waiting on Ben for anything else, but …) I didn’t see this discussion about profiles in the new -08 text.

Agreed, fixed.

We've fleshed out the text in draft-ietf-babel-rfc6126bis and kept the reference
in draft-ietf-babel-dtls.

Done.

(7) Section 2.6  Suggest being clearer that this is a deployment not an
implementation issue. s/Implementations<http://s/Implementations> MAY implement both Babel over DTLS and
unprotected Babel./ /A node MAY run both Babel over DTLS and unprotected Babel./

Agreed. We added your new sentence but also kept the old one since both are true.

(10) Editorial

Done

-- Section 3.  Nit. s/ciphers/ciphersuites/<http://s/ciphers/ciphersuites/>

Done

[Roman] Thanks for all of the changes above!

Regards,
Roman

---

From: David Schinazi <[email-masked]>
Date: Mon, 12 Aug 2019 20:00:47 -0700

Thanks for your reply!

On Mon, Aug 12, 2019 at 4:35 PM Roman Danyliw <[email-masked]> wrote:

> Ben’s recommendation to explicitly note that this authentication needs to
> be solved in external profiles would address my concern too:
>
>
>
> (I don’t know if you were waiting on Ben for anything else, but …) I
> didn’t see this discussion about profiles in the new -08 text.
>
>
The new profile text was added after -08 was submitted, it's in this commit:
https://github.com/jech/babel-drafts/commit/458a9ae6b9b136122d8668b26ba403f4f3a57167

Does it resolve your concern?
If yes we'll submit a -09 with this new text.

Thanks,
David

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 13 Aug 2019 14:29:42 +0000

Hi David!

Sent: Monday, August 12, 2019 11:01 PM

Thanks for your reply!

On Mon, Aug 12, 2019 at 4:35 PM Roman Danyliw <[email-masked]<mailto:[email-masked]>> wrote:
Ben’s recommendation to explicitly note that this authentication needs to be solved in external profiles would address my concern too:

[Roman]  Understood.  Yes, that text resolves my concern.  Thank you.

Roman

---

From: David Schinazi <[email-masked]>
Date: Tue, 13 Aug 2019 15:50:04 -0700

Thanks Roman! We've now uploaded -09 with the new text:
https://tools.ietf.org/html/draft-ietf-babel-dtls-09

David

On Tue, Aug 13, 2019 at 7:29 AM Roman Danyliw <[email-masked]> wrote:

> Hi David!
>
>
>
> *From:* David Schinazi [mailto:[email-masked]]
> *Sent:* Monday, August 12, 2019 11:01 PM
> *To:* Roman Danyliw <[email-masked]>
> *Cc:* The IESG <[email-masked]>; [email-masked]; Donald
> Eastlake <[email-masked]>; babel-chairs <[email-masked]>; Babel
> at IETF <[email-masked]>
> *Subject:* Re: Roman Danyliw's Discuss on draft-ietf-babel-dtls-07: (with
> DISCUSS and COMMENT)
>
>
>
> Thanks for your reply!
>
>
>

---

From: David Schinazi <[email-masked]>
Date: Mon, 19 Aug 2019 09:10:29 -0700

Hi Roman,

Would you be able to take a look at draft -09 and update your ballot
position please?
https://tools.ietf.org/html/draft-ietf-babel-dtls-09

Thanks,
David

On Tue, Aug 13, 2019 at 3:50 PM David Schinazi <[email-masked]>
wrote:

>> *Subject:* Re: Roman Danyliw's Discuss on draft-ietf-babel-dtls-07:
>> (with DISCUSS and COMMENT)
>>
>>
>>
>> Thanks for your reply!
>>
>>
>>

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 27 Aug 2019 17:58:37 +0000

Hi David!

Thanks for publishing these changes as -09.  The revised text addressed my concerns and I’ve cleared my ballot to reflect that.

Thanks,
Roman

Sent: Monday, August 19, 2019 12:10 PM

Hi Roman,

Would you be able to take a look at draft -09 and update your ballot position please?
https://tools.ietf.org/html/draft-ietf-babel-dtls-09

Thanks,
David

On Tue, Aug 13, 2019 at 3:50 PM David Schinazi <[email-masked]<mailto:[email-masked]>> wrote:
Thanks Roman! We've now uploaded -09 with the new text:
https://tools.ietf.org/html/draft-ietf-babel-dtls-09

David

On Tue, Aug 13, 2019 at 7:29 AM Roman Danyliw <[email-masked]<mailto:[email-masked]>> wrote:
Hi David!

From: David Schinazi [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Monday, August 12, 2019 11:01 PM
To: Roman Danyliw <[email-masked]<mailto:[email-masked]>>
Cc: The IESG <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; Donald Eastlake <[email-masked]<mailto:[email-masked]>>; babel-chairs <[email-masked]<mailto:[email-masked]>>; Babel at IETF <[email-masked]<mailto:[email-masked]>>
Subject: Re: Roman Danyliw's Discuss on draft-ietf-babel-dtls-07: (with DISCUSS and COMMENT)

Thanks for your reply!

Roman