Subject: RE: [NSIS] Next steps for the analysis document

From: Tschofenig Hannes <[email-masked]>
Date: Fri, 17 Oct 2003 13:45:54 +0200

i will do my best. 

> -----Original Message-----
> From: Jukka MJ Manner [mailto:[email-masked]]
> Sent: Friday, October 17, 2003 1:42 PM
> To: Tschofenig Hannes
> Cc: [email-masked]
> Subject: RE: [NSIS] Next steps for the analysis document
> 
> 
> 
> Hi Hannes,
> 
> It is true that most protocols do not consider security at 
> all or expect 
> some weird things, or even rely on someone else to do 
> security. At least 
> some overall security section is needed, perhaps our dear Chair can 
> provide feedback to your review.
> 
> Cheers,
> Jukka
> 
> On Fri, 17 Oct 2003, Tschofenig Hannes wrote:
> 
> > hi jukka, 
> > 
> > i will re-read the document again to address the security issues. 
> > i have once read all the described protocols with respect 
> to security.
> > unfortunately, the  security considerations in many of 
> these protocols is
> > lacking a useful level of detail. 
> > 
> > ciao
> > hannes
> > 
> > 
> > > -----Original Message-----
> > > From: Jukka MJ Manner [mailto:[email-masked]]
> > > Sent: Friday, October 17, 2003 1:23 PM
> > > To: [email-masked]
> > > Subject: [NSIS] Next steps for the analysis document
> > > 
> > > 
> > > 
> > > Hi all,
> > > 
> > > I would need to make (hopefully final) changes to the 
> > > Analysis draft. I'm
> > > trying to figure out what needs to be done. I would need 
> the WG's view
> > > (yes, that means you, too) on what is missing (needs work) in 
> > > the draft.  
> > > At least issues 1,2 and 3 would need the WGs view as a whole, 
> > > other items
> > > are more or less directed to certain individuals or the draft 
> > > editors.  
> > > Here is a list of issues:
> > > 
> > > 
> > > 1) Remove the Appendix? Was there some comments about keeping 
> > > it, I think 
> > > someone liked it in Vienna? Or was it clear to remove it?
> > > 
> > > 
> > > 2) Add a short review of SICAP, a protocol similar to BGRP? 
> > > (See Helena
> > > Rute Sofia's email on July 16th 2003) (SICAP description July 
> > > 17th 2003)
> > > 
> > > 
> > > 3) What about adding an RMD evaluation? Or any other text? 
> > > (see Georgios'
> > > email on July 17 2003) (some discussions July 17th -> July 
> > > 22nd, Sep 5)
> > > 
> > > 
> > > 4) Hannes to review the security section? A short summary 
> and pointers
> > > to his documents?
> > > 
> > > 
> > > 5) Section 3.5 needed more proof, need to ask Ping to review 
> > > the text.  
> > > See John's email on July 7th 2003.
> > > 
> > > 
> > > 6) Is there text that could be taken from Michael Thomas' 
> draft on 
> > > mobility issues?
> > > 
> > > 
> > > 7) Add a reference that shows how YESSIR is as good as 
> > > claimed in Section
> > > 6.2.1 (Ping?)
> > > 
> > > 
> > > 8) Add reference to Tenet (mail from Alejandro Avella Jul 
> 12 2003):
> > > (Page 20, Section 6.1)
> > > Anindo Banerjea, Domenico Ferrari, Bruce A. Mah, Mark Moran, 
> > > Dinesh C. 
> > > Verma, Hui Zhang
> > > The Tenet Real-Time Protocol Suite: Design, Implementation, and  
> > > Experiences (1996)
> > > IEEE ACM Transactions on Networking
> > > http://citeseer.nj.nec.com/banerjea96tenet.html
> > > 
> > > 
> > > 9) Split the references into (only?) "Non-Normative"
> > > 
> > > 
> > > 10) Add a summary
> > > 
> > > 
> > > Regards,
> > > Jukka
> > > 
> > > 
> > > _______________________________________________
> > > nsis mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/nsis
> > > 
> > 
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Tschofenig Hannes <[email-masked]>
Date: Fri, 17 Oct 2003 14:14:54 +0200

hi nary,  

the analysis document does not have a security consideration section
addressing the content of the draft. instead the security consideration
section and some sections within the document touch the security of the
protocols discussed in the document. 

for many of the protocols it was really difficult to figure out how a
security solution could work. some protocols provide a one-line guidance on
security. hence you can only speculate. at the helsinki interim meeting i
have given some examples of protocols. you can find the slides attached to
the meeting minutes. 

for rsvp things are difference and hence we were able to write an entire
draft on this issue (btw, comments are still welcome). 

i think it is still useful to look at the protocols described in the
document again and to verify what was said in the draft (particularly since
some additional protocols will be added). i will not be able to provide
"major" input within the next two weeks (since i have to incorporate changes
into some other drafts) but we can discuss some of these issues at the next
ietf (if someone is interested). 

ciao
hannes

> From: Thanh Tra LUU [mailto:[email-masked]]
> Sent: Friday, October 17, 2003 1:55 PM
> To: Jukka MJ Manner
> Cc: [email-masked]
> Subject: Re: [NSIS] Next steps for the analysis document
> 
> 
> hi Jukka,
> 
> I agree with you. However, it seems difficult to see all 
> security aspects
> when writing a document. I think it will be better if we (readers, or
> someone are security experts) can send authors the feedback 
> of  security
> when we see the security problems. After that, the authors 
> can update their
> documents.
> 
> Best regards
> 
> Nary Tra
> 
> 
> 
> ----- Original Message -----
> From: "Jukka MJ Manner" <[email-masked]>
> To: "Tschofenig Hannes" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Friday, October 17, 2003 1:41 PM
> these protocols
> is
> > > > trying to figure out what needs to be done. I would 
> need the WG's view
> > > > 4) Hannes to review the security section? A short 
> summary and pointers
> > > > to his documents?
> > > >
> > > >
> > > > 6) Is there text that could be taken from Michael 
> Thomas' draft on
> > > > mobility issues?
> > > >
> > > >
> > > > 8) Add reference to Tenet (mail from Alejandro Avella 
> Jul 12 2003):
> > > > (Page 20, Section 6.1)

---

From: Attila Báder (IJ/ETH)<[email-masked]>
Date: Fri, 17 Oct 2003 15:05:50 +0200

Hi Jukka,

RMD is an example of stateless/reduced state operation mode discussed in QoS-NSLP draft, so, I think, it would be useful if it is mentioned in the analysis draft in this context.

Best regards, Attila

> Sent: Friday, October 17, 2003 2:46 PM
> To: Georgios Karagiannis
> Cc: [email-masked]
> Hi Georgios, 
> I know there has been some discussions, that is why I put 
> those pointers
> to some of them. I was still wondering whether people want to 
> see the RMD
> stuff added, whether it makes the draft better by adding new 
> insights, for
> example?
> 
> Regards,
> Jukka
> 
> On Fri, 17 Oct 2003, Georgios Karagiannis wrote:
> 
> > Hi Jukka
> > 
> > Regarding point 3) we have had some discussions within the WG.
> > Hopefully I have had provided the required information.
> > 
> > Best regards,
> > Georgios
> > 
> > 
> > To: <[email-masked]>
> > > (yes, that means you, too) on what is missing (needs 
> work) in the draft.
> > > At least issues 1,2 and 3 would need the WGs view as a 
> whole, other items
> > > are more or less directed to certain individuals or the 
> draft editors.
> > > 1) Remove the Appendix? Was there some comments about 
> keeping it, I think
> > > 2) Add a short review of SICAP, a protocol similar to 
> BGRP? (See Helena
> > > Rute Sofia's email on July 16th 2003) (SICAP description 
> July 17th 2003)
> > >
> > >
> > > 3) What about adding an RMD evaluation? Or any other 
> text? (see Georgios'
> > > email on July 17 2003) (some discussions July 17th -> 
> July 22nd, Sep 5)
> > >
> > >
> > > 5) Section 3.5 needed more proof, need to ask Ping to 
> review the text.
> > > 6) Is there text that could be taken from Michael Thomas' draft on
> > > mobility issues?
> > >
> > >
> > > Anindo Banerjea, Domenico Ferrari, Bruce A. Mah, Mark 
> Moran, Dinesh C.
> > > Verma, Hui Zhang

---

From: [email-masked]
Date: Fri, 17 Oct 2003 16:21:46 +0300

Hi Jukka,

> It is true that most protocols do not consider security at all or expect 
> some weird things, or even rely on someone else to do security. At least 

I don't think that we can do an exhaustive review of the security of
the protocols.  However, if there are any security sections or
references, they should be explicitly cited.  If no security considerations
can be found, than that needs to be explicitly stated.

John