Subject: [babel] Éric Vyncke's No Objection on draft-ietf-babel-dtls-07: (with COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Mon, 05 Aug 2019 00:37:46 -0700

Éric Vyncke has entered the following ballot position for
draft-ietf-babel-dtls-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-babel-dtls/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for the work put into this document. I have only two COMMENTs.

Regards,

-éric

== COMMENTS ==

-- Section 1.2 --

The text refers to the security consideration of RFC6121bis for an extended
comparison of HMAC & DTLS except that there is no additional information in RFC
6121bis.

-- Section 2.1 --

It is a little unclear to me whether a mix of DTLS and non-DTLS Babel nodes can
exist on the same layer-2 network. I guess no (as implied later) but a clear
sentence would help.

---

From: David Schinazi <[email-masked]>
Date: Wed, 7 Aug 2019 11:18:35 -0700

Hello Eric, and thanks for your review! Responses inline:

-- Section 1.2 --
> comparison of HMAC & DTLS except that there is no additional information

babel-dtls states "A comparison of Babel security mechanisms and
   their applicability can be found in [RFC6126bis]."

The Security Considerations section of RFC6126bis does have such a
comparison:
https://tools.ietf.org/html/draft-ietf-babel-rfc6126bis-12#section-6

The comparison is pretty short: in a nutshell use HMAC if it fits your
needs because
it's simpler, otherwise use DTLS because it has more features.

The text is laid out this way because we thought it was best to have the
main Babel
document discuss the properties of the security solutions and have the
security
documents simply point to that instead of repeating the text.

> exist on the same layer-2 network. I guess no (as implied later) but a

Technically you could run a mix of DTLS and non-DTLS Babel nodes on the same
layer 2 network, but they would behave as "ships in the night" and ignore
each other
because they wouldn't be able to establish bidirectional reachability. That
is also true
of running Babel and any other routing protocol on the same network. This
seems
pretty standard as far as routing goes, but if you could suggest some text
we could
add it?

Thanks,
David