Subject: Re: [clue] Ben Campbell's Yes on draft-ietf-clue-framework-24: (with COMMENT)

From: Christian Groves <[email-masked]>
Date: Mon, 4 Jan 2016 13:44:07 +1100

Hello Ben,

Please see my replies below.

Regards, Christian

On 25/12/2015 9:53 AM, Ben Campbell wrote:
> Hi, A couple more comments below:
>
> Thanks!
>
> Ben.
>
>
> On 22 Dec 2015, at 17:18, Christian Groves wrote:
>
>> Hello Mark,
>>
>> Some comments below on your replies.
>>
>> Regards,
>> Christian
>>
>> On 23/12/2015 5:16 AM, Duckworth, Mark wrote:
>>> Hello Ben,
>>> Thanks for the feedback.
>>> I have a few more responses to your comments below.
>>> Mark
>>>
>>>> -----Original Message-----
>>>> From: Ben Campbell [mailto:[email-masked]]
>>>> Sent: Tuesday, December 15, 2015 5:57 PM
>>>> ----------------------------------------------------------------------
>>>> COMMENT:
>>>> ----------------------------------------------------------------------
>>>>
>>>> I have some minor comments. These should be easy to resolve, and I 
>>>> don't
>>>> think any are show-stoppers.
>>>>
>>>> === Subtantive ===
>>>>
>>>> - Section 3, MCU definition.
>>>> Does this need a normative reference to 4353? I'm not sure the 
>>>> definition
>>>> can be understood as written without reading it.
>>> [Duckworth, Mark] I don't know. Is there any objection to making 
>>> RFC4353 a normative reference?
>> [CNG] I'm not sure its appropriate. The definition says 
>> "RFC4353-like" (doesn't sound particularly normative) and says then 
>> indicates that the MCU is without a RFC4353. Again its not 
>> normatively saying to use it. Just because the reference is 
>> information doesn't mean a person shouldn't read it if they're 
>> unfamiliar with it.
>
> It goes on to say "without the [RFC4353] requirement".
>
> The criteria for a normative reference is one that is required to 
> fully implement or understand the draft. I agree this one is 
> borderline. If you think someone can understand the MCU definition 
> without it well enough for the purposes of the document, then I won't 
> push on it.

[CNG] I think the way MCU is used in CLUE the definition is sufficient. 
The MCU is simply one class of device that may use CLUE.

>
> [...]
>
>>
>>>> -6, third bullet:
>>>> It seems kind of odd to use a  MUST for this,  given that the 
>>>> criteria of
>>>> professionally installed is somewhat vague. I think a non-normative
>>>> recommendation would make more sense.
>>> [Duckworth, Mark] It does seem odd. I think the working group 
>>> previously discussed this and decided on using MUST.
>> [CNG] The MUST relates to systems that know their physical dimensions 
>> providing them in an Advertisement rather than relating to 
>> professionally installed systems. We could strike the "(for example 
>> professionally installed Telepresence room systems)" if that's 
>> causing a problem.
>
> Please see my related comment to Mark.
>
> [...]
>
>>>
>>>> -15, paragaph 4: "DTLS/SRTP MUST be supported and SHOULD be used
>>>> unless
>>>> the media, which is based on RTP, is secured by other means..."
>>>> Is "secured by other means" intended to be the sole exception? If so,
>>>> then this might should say MUST ... unless". As defined in 2119, a 
>>>> SHOULD
>>>> would allow an implementation to skip the protection for other 
>>>> reasons,
>>>> if the implementer was aware of the implications, etc...
>>>> Also, should the references to 7201 and 7202 be normative?
>>> [Duckworth, Mark] I don't know. Does anybody else have a suggestion 
>>> about this?
>> [CNG] I think the wording around this was discussed for awhile and 
>> what's in the framework was the compromise we came up with, i.e. "Its 
>> a really good idea to secure the media using SRTP-DTLS, but we can't 
>> force you if you have a reason not to".
>
> "If you have a good reason not to" is substantially different than "if 
> you are secured by other means".
[CNG] Yes, true. Of course one of the reasons could be "if you are 
secured by other means". I think the main case that was considered was 
two endpoints operating inside one companies network. People felt the 
same level of security may not be needed as the wider internet.