Subject: [dhcwg] IESG Discusses on draft-ietf-dhc-relay-server-security-04

From: "Bernie Volz (volz)" <[email-masked]>
Date: Wed, 19 Apr 2017 19:00:01 +0000

Hi:

I've posted a -05 which tries to address the Discusses (except perhaps for Ben Campbell's about which I sent a separate email on 4/12). Please review and let me know if this helps or whether more changes are needed.

A new version of I-D, draft-ietf-dhc-relay-server-security-05.txt
has been successfully submitted by Bernie Volz and posted to the IETF repository.

Name:		draft-ietf-dhc-relay-server-security
Revision:	05
Title:		Security of Messages Exchanged Between Servers and Relay Agents
Document date:	2017-04-19
Group:		dhc
Pages:		8
URL:            https://www.ietf.org/internet-drafts/draft-ietf-dhc-relay-server-security-05.txt
Status:         https://datatracker.ietf.org/doc/draft-ietf-dhc-relay-server-security/
Htmlized:       https://tools.ietf.org/html/draft-ietf-dhc-relay-server-security-05
Htmlized:       https://datatracker.ietf.org/doc/html/draft-ietf-dhc-relay-server-security-05
Diff:           https://www.ietf.org/rfcdiff?url2=draft-ietf-dhc-relay-server-security-05

- Bernie Volz

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 20 Apr 2017 07:24:34 -0400

Hmm... I don't think this really resolves my concern, which is: is anyone
going to actually do this.

I don't think that has to be in the draft, but I'd like understand it.

-Ekr

On Wed, Apr 19, 2017 at 3:00 PM, Bernie Volz (volz) <[email-masked]> wrote:

> Hi:
>
> I've posted a -05 which tries to address the Discusses (except perhaps for
> Ben Campbell's about which I sent a separate email on 4/12). Please review
> and let me know if this helps or whether more changes are needed.
>
> Htmlized:       https://datatracker.ietf.org/
> doc/html/draft-ietf-dhc-relay-server-security-05

---

From: "Bernie Volz (volz)" <[email-masked]>
Date: Thu, 20 Apr 2017 13:39:07 +0000

Eric:

I can’t say whether anyone would actually do this.

On the one hand, NOT having this document may make it less likely that anyone would, so having the document COULD mean someone will make use of it.

I also think that there may be little to add to a server or relay implementation to do this since it may just require some “host” configuration – as in https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Security_Guide/s1-ipsec-host2host.html. Thus the bar to implement is low – just requires some additional host configuration. Of course, it may be more difficult to deploy on relays (on routers)?

One reason that I think that this may not be used heavily (if at all) is that most of the relay to server commination is in probably flowing in an operator’s infrastructure (data center) network and hence they likely have secured that infrastructure communication in general and thus the relay to relay / relay to server communication may be part of that – this may be the same path used to manage the relays, for example.

-          Bernie

From: Eric Rescorla [mailto:[email-masked]]
Sent: Thursday, April 20, 2017 7:25 AM
To: Bernie Volz (volz) <[email-masked]>
Cc: The IESG <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re: IESG Discusses on draft-ietf-dhc-relay-server-security-04

Hmm... I don't think this really resolves my concern, which is: is anyone going to actually do this.

-Ekr

On Wed, Apr 19, 2017 at 3:00 PM, Bernie Volz (volz) <[email-masked]<mailto:[email-masked]>> wrote:
Hi:

- Bernie Volz

---

From: "Yogendra Pal (yogpal)" <[email-masked]>
Date: Thu, 20 Apr 2017 14:09:57 +0000

FYI...Hi Bernie and Eric,

We're planning to implement this in our firewall product (ASA).

Regards, Yogendra
From: "Bernie Volz (volz)" <[email-masked]<mailto:[email-masked]>>
Date: Thursday, 20 April 2017 7:09 pm
To: Eric Rescorla <[email-masked]<mailto:[email-masked]>>
Cc: The IESG <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: IESG Discusses on draft-ietf-dhc-relay-server-security-04
Resent-From: <[email-masked]<mailto:[email-masked]>>
Resent-To: <[email-masked]<mailto:[email-masked]>>, Yogendra Pal <[email-masked]<mailto:[email-masked]>>
Resent-Date: Thursday, 20 April 2017 7:09 pm

Eric:

I can't say whether anyone would actually do this.

I also think that there may be little to add to a server or relay implementation to do this since it may just require some "host" configuration - as in https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Security_Guide/s1-ipsec-host2host.html. Thus the bar to implement is low - just requires some additional host configuration. Of course, it may be more difficult to deploy on relays (on routers)?

One reason that I think that this may not be used heavily (if at all) is that most of the relay to server commination is in probably flowing in an operator's infrastructure (data center) network and hence they likely have secured that infrastructure communication in general and thus the relay to relay / relay to server communication may be part of that - this may be the same path used to manage the relays, for example.

-          Bernie

From: Eric Rescorla [mailto:[email-masked]]
Sent: Thursday, April 20, 2017 7:25 AM
To: Bernie Volz (volz) <[email-masked]<mailto:[email-masked]>>
Cc: The IESG <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: IESG Discusses on draft-ietf-dhc-relay-server-security-04

-Ekr

- Bernie Volz

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 21 Apr 2017 12:45:26 -0400

Sent from my iPhone

> On Apr 20, 2017, at 10:09 AM, Yogendra Pal (yogpal) <[email-masked]> wrote:
> 
> FYI…Hi Bernie and Eric,
> 
> We’re planning to implement this in our firewall product (ASA).

Excellent, glad to hear it!

Kathleen 
> 
> Regards, Yogendra
> From: "Bernie Volz (volz)" <[email-masked]>
> To: Eric Rescorla <[email-masked]>
> Cc: The IESG <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
> Resent-From: <[email-masked]>
> Resent-To: <[email-masked]>, Yogendra Pal <[email-masked]>