Subject: Re: [dtn] TCPCLv4 comments

From: "R. Atkinson" <[email-masked]>
Date: Wed, 29 Mar 2017 10:02:54 -0400

>  - I am absolutely fine with making TLS mandatory (my own use of TCPCL is to always require TLS),
> as it would simplify logic. Some may dislike this, but if it's easier for approval then I would prefer that.
> There would be no prohibition from somebody implementing a "TCPCLv4 without TLS" as a
> separate thing for closed networks.

The text quoted above is ambiguous, so I can’t figure out what it means.  

The IETF has for about 30 years now taken 2 complementary positions on security:
  A.  Security has to be specified and Security has to be “MUST implement”, so that is is available to use in all shipping products.
  B.  Security is OPTIONAL to deploy/use and this is left as a decision for the network operator or user.

The IETF generally avoids telling operators what they have to do.  Yes, we do have a growing
number of “Best Current Practice (BCP)” documents, but that is in the category of strong advice,
rather than a standards mandate.

I concur with the long-standing IETF position on security.  

So in the context of TCPCL, I believe it is very important for TLS to be “MUST implement”, 
but I object to any notion that EITHER “standards-compliant deployments” OR “interoperable
deployments” MUST deploy/user” TLS.

In short, it needs to be possible to interoperate fully - whether or not - one happens 
to *use* (“deploy”) TLS  for a particular TCPCL session.  

Yours,

Ran

---

From: Brian Sipos <[email-masked]>
Date: Thu, 30 Mar 2017 13:01:02 +0000

Ran,

The original thought behind mandatory-to-use TLS was to simplify the TCPCL state machine, but if there is a need to allow TCPCLv4 to be usable in complete absence of TLS on an endpoint (and from the discussion yesterday it sounds like yes, there is) then this is already accommodated by the current TCPCL draft. It makes use of a STARTTLS-like mechanism to upgrade a TCP connection if both endpoints support it.

With all of this in mind, would you be willing to review the current draft spec regarding the contact header and TCPCL session establishment (sections 4 and 5.3 respectively) for its completeness? Any comments in this area are very much welcome so that we can avoid any undesirable behaviors in this important area of operation.

Thank you,

Brian S.

________________________________
From: dtn <[email-masked]> on behalf of R. Atkinson <[email-masked]>
Sent: Wednesday, March 29, 2017 10:02:54 AM
To: [email-masked]
Subject: Re: [dtn] TCPCLv4 comments

Yours,

Ran

_______________________________________________
dtn mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dtn