Subject: [ippm] Use TLS in TWAMP-Control?

From: Al Morton <[email-masked]>
Date: Sun, 09 Nov 2008 10:19:25 -0500

IPPM folks,

At the last IPPM session in Dublin, we had a short discussion
on TWAMP security in the context of the various TWAMP extensions
proposed there:

 From http://www.ietf.org/proceedings/08jul/minutes/ippm.txt
>Discussion about TWAMP security
>- Lars: Formerly there were some strong security concerns about OWAMP,
>   but allowed to go through.  Building TWAMP on OWAMP raised those
>   concerns again.  Are extensions like this going to raise more
>   concerns?  What can be done to make security people happier?
>- Al: Going to have to ask security people what their concerns are.
>- Henk, Stas: Do not have records of reservations from security people.

I took the opportunity to discuss the proposed extensions
with Pasi Eronen one evening in Dublin. To briefly summarize,
Pasi did not have concern with the proposed TWAMP features, but suggested
that IPPM take a look at using TLS in the TWAMP Control protocol
and assess the interest to implement a TLS-Control option if
it were available. I agreed to re-initiate the investigation and
discussion, and that's what I'm doing now...

I put a few slides together and posted them here temporarily:
http://wftp3.itu.int/packet/Background%20Docs/TLS_in_TWAMP_1108.ppt
I've only looked at the initial Control session set-up impact.
We can discuss this topic on the list, and perhaps if there's time
on the IPPM agenda, perhaps we can spend a few minutes there as well.

Some of the issues with using TLS in OWAMP-Control are identified in
http://tools.ietf.org/html/rfc4656#section-6.6

Another resource is a draft from the NETCONF wg:
http://tools.ietf.org/html/draft-ietf-netconf-tls-06
This memo describes how to use TLS to secure NETCONF.
There are some clear synergies between NETCONF and TWAMP-Control,
but
1,$ s/NETCONF/TWAMP-Control/g
isn't going to do it for us.  :-D

regards,
Al

_______________________________________________
ippm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ippm