Subject: [CDNi] I-D Action: draft-ietf-cdni-redirection-07.txt

From: [email-masked]
Date: Wed, 04 Feb 2015 01:09:37 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Content Delivery Networks Interconnection Working Group of the IETF.

        Title           : Request Routing Redirection Interface for CDN Interconnection
        Authors         : Ben Niven-Jenkins
                          Ray van Brandenburg
	Filename        : draft-ietf-cdni-redirection-07.txt
	Pages           : 31
	Date            : 2015-02-04

Abstract:
   The Request Routing Interface comprises of (1) the asynchronous
   advertisement of footprint and capabilities by a downstream CDN that
   allows an upstream CDN to decide whether to redirect particular user
   requests to that downstream CDN; and (2) the synchronous operation of
   an upstream CDN requesting whether a downstream CDN is prepared to
   accept a user request and of a downstream CDN responding with how to
   actually redirect the user request.  This document describes an
   interface for the latter part, i.e. the CDNI Request Routing
   Redirection interface.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-cdni-redirection/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-cdni-redirection-07

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-cdni-redirection-07

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Francois Le Faucheur (flefauch)" <[email-masked]>
Date: Wed, 4 Feb 2015 09:40:05 +0000

Hi Ben,

The text added about TLS looks good to me.

But I noticed the old text about TLS is still there:
"In order to prevent passive interception of RI messages the RI
   communications channel MUST be suitably secured (e.g. use of TLS).
 
  In order to reduce the risk of information leakage to unauthorized
   parties, RI clients and servers MUST use suitable authentication
   prior to trusting the contents of RI messages.
"
I believe it should be removed, since it is now overridden by the following new text : "In an environment where any such protection is required, TLS SHOULD
   be used”  (where “protection" has been defined before as authentication, confidentiality and integrity). 

Can you re-issue without the two “old” sentences?

Thanks

Francois

PS: noticed one typo :
"CDNI Redirection minterface” —> "CDNI Redirection interface"

> On 4 Feb 2015, at 10:09, [email-masked] wrote:
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Ben Niven-Jenkins <[email-masked]>
Date: Thu, 5 Feb 2015 13:14:56 +0000

Francois,

>   be used”  (where “protection" has been defined before as authentication, confidentiality and integrity). 

I do not think the old text and the added text conflict with each other but are complementary. The old text states the general requirements, i.e. comms channel MUST be suitably secured & suitably authenticated. The new text then requires that implementations implement TLS for an interoperable means to meet the general requirements.

Having both makes it clear that if TLS is not used then a suitably secured & authenticated alternative still MUST be used.

Ben

---

From: "Francois Le Faucheur (flefauch)" <[email-masked]>
Date: Thu, 5 Feb 2015 16:15:03 +0000

Hi Ben,

> Having both makes it clear that if TLS is not used then a suitably secured & authenticated alternative still MUST be used.

I think your concern is that we want to be sure that if one does not use TLS, one needs to do the right thing. That is a valid concern.

However:

1) I think this goal is already achieved with the “new” text because of the RFC2119 meaning of “SHOULD”:
"This word, or the adjective "RECOMMENDED", mean that there
   may exist valid reasons in particular circumstances to ignore a
   particular item, but the full implications must be understood and
   carefully weighed before choosing a different course.”
So this does say that if you want to do something different, you need to really understand and “need to do the right thing” (which may be to not use any security mechanism, use some weaker ones, use some stonger ones, use some partial ones,..). 

2) the new text does not really add much because it does not mandate any mechanism nor does it indicate what is “suitable” for what enviornment (ie again, no mechanism at all may be perfectly suitable in some cases).

3) the old text and new text do not dovetail nicely. For example, the old text does not say anything about integrity protection. So I think if we wnated to add something, we should rephrase the “old” text so it fits with the flow of the new text.

Say, we have :

	Proposition 1:
		you SHOULD use TLS

	Proposition 2:
		you MUST do the right thing
		and you SHOULD use TLS

in mind mind, given the definition of “SHOULD” proposition 1 and proposition 2 are equivalent, so I’d rather stick to Proposition 1.
No?

Also, I believe this discussion applies equally to all interfaces, so we should reflect the outcome of this discussion to all interfaces.

Francois

---

From: Ben Niven-Jenkins <[email-masked]>
Date: Sat, 7 Feb 2015 17:16:24 +0000

Francois,

I have published a -08 that removes the offending sentences.

Regards
Ben