Subject: Re: [dhcwg] [Int-dir] Review of draft-ietf-dhc-relay-server-security-02

From: Suresh Krishnan <[email-masked]>
Date: Wed, 1 Feb 2017 19:56:53 +0000

Hi Jouni,
  Thanks for the review. 

> On Jan 27, 2017, at 3:20 PM, jouni.nospam <[email-masked]> wrote:
> 
> 
>> On Jan 26, 2017, at 11:27 AM, Ted Lemon <[email-masked]> wrote:
>> 
>> On Jan 26, 2017, at 1:58 PM, jouni.nospam <[email-masked]> wrote:
>>> No. But in this case there are pieces of text that change specific places in the original document from SHOULDs to MUSTs, musts to MUSTs, and adds few pieces of new stuff, etc. Now how that in not updating? Changes or “extensions” like that would be nice to follow from the base document.
>> 
>> Okay, I see your point.   But suppose the document were changed so that rather than "updating" the document as you suggest, it simply referenced the sections in question and then made the SHOULDs into MUSTs that way?   Wouldn't that mean "implementations of this extension MUST," and wouldn't that be perfectly reasonable?
>> 
> 
> I would still argue that it updates specifically if the document here is going to be standards track. If this document here would be more of a recommendation e.g., BCP I would be fine without the “updating” part (as I remember the MUST for IPsec in RFC3315bis was not endorsed by the WG).

I think the other two items in your review need to be fixed. But I have a slightly different take on this specific issue. In my view this document needs to stay on Standards track, and it should be made clear that it is an (optional) extension to RFC3315. This allows people who have implemented encryption for server-relay communications to claim compliance to RFC3315 and this document. For RFC3315bis, I think it should be discussed in the WG whether to mandate encryption or not as there are backward compatibility related considerations to be made.

Regards
Suresh

---

From: "jouni.nospam" <[email-masked]>
Date: Fri, 3 Feb 2017 13:21:00 -0800

Suresh,

> On Feb 1, 2017, at 11:56 AM, Suresh Krishnan <[email-masked]> wrote:
> 
> Hi Jouni,
>  Thanks for the review. 
> 

I guess that works for me. In this case IMHO *-dhc-relay-server-security-* would be more of a profile for RFC3315 IPsec based security. I would find that useful.

Can you explain what is the real difference between extends vs. updates?

- Jouni