Subject: [nvo3] Poll for WG adoption of draft-hartman-nvo3-security-requirements-01

From: "Bocci, Matthew (Matthew)" <[email-masked]>
Date: Fri, 23 Aug 2013 15:22:22 +0000

This email begins a two week poll to help the chairs determine if there is consensus to adopt draft-hartman-nvo3-security-requirements-01.txt as an NVO3 working group draft.

The draft can be found here:
http://tools.ietf.org/id/draft-hartman-nvo3-security-requirements-01.txt

Please read the draft and indicate to the list if you support adoption, or if you do not support adoption (giving reasons).

Please note that this is only a call for adoption. There needs to be consensus that this draft is a good basis for the work, but it does not need to be perfect at this stage.

The poll for adoption will close in two weeks time, on Friday 6th September.

Best regards,

Matthew and Benson

---

From: Lucy yong <[email-masked]>
Date: Fri, 23 Aug 2013 15:23:54 +0000

Support!
Lucy

From: [email-masked] [mailto:[email-masked]] On Behalf Of Bocci, Matthew (Matthew)
Sent: Friday, August 23, 2013 10:22 AM
To: [email-masked]
Subject: [nvo3] Poll for WG adoption of draft-hartman-nvo3-security-requirements-01

Best regards,

Matthew and Benson

---

From: Linda Dunbar <[email-masked]>
Date: Fri, 23 Aug 2013 15:34:49 +0000

Support.

Linda

Best regards,

Matthew and Benson

---

From: Melinda Shore <[email-masked]>
Date: Fri, 23 Aug 2013 09:21:49 -0800

On 8/23/13 7:22 AM, Bocci, Matthew (Matthew) wrote:
> This email begins a two week poll to help the chairs determine if there
> is consensus to adopt draft-hartman-nvo3-security-requirements-01.txt as
> an NVO3 working group draft.

What's the reason for not incorporating this material into
the other requirements drafts?  I think that the text is a
good start but I am generally not that enthusiastic about
moving security issues into separate documents unless
there's a compelling reason.

Melinda

---

From: Eric Gray <[email-masked]>
Date: Tue, 27 Aug 2013 21:29:24 +0000

Support.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Bocci, Matthew (Matthew)
Sent: Friday, August 23, 2013 11:22 AM
To: [email-masked]
Subject: [nvo3] Poll for WG adoption of draft-hartman-nvo3-security-requirements-01

Best regards,

Matthew and Benson

---

From: "Zhangdacheng (Dacheng)" <[email-masked]>
Date: Thu, 29 Aug 2013 06:24:46 +0000

Hi, Melinda:

Sorry for the delayed reply. I agree there should be security analysis work in each requirement document. However, I believe NVO3 networks could be very complex, and it is reasonable, at least at the moment, for us to analyze the system in a comprehensive way instead of splitting them into different parts and analyzing them respectively, since, for example, the attacks on a component may be a step of a more complex attack targeting another component and the security issues with the data plane may also be applied to attack the control plane. In addition, it is also useful for us to make a good threat model and reasonable assumptions of attacking capability before specifying the security requirements for data and control planes. It is very important for us to agree upon which security properties that we should guarantee and what kind of attacks we need to consider before moving forward.

So, I think it is proper to put the work mentioned above into an individual document. But if the group would like us to put the conclusion of our analysis into other documents or help the authors of other documents do the security related work, we would be very happy to do so. ^_^

Cheers

Dacheng

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Melinda Shore
> Sent: Saturday, August 24, 2013 1:22 AM
> To: [email-masked]
> Subject: Re: [nvo3] Poll for WG adoption of
> draft-hartman-nvo3-security-requirements-01
> 
> _______________________________________________
> nvo3 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nvo3

---

From: Melinda Shore <[email-masked]>
Date: Wed, 28 Aug 2013 22:34:17 -0800

On 8/28/13 10:24 PM, Zhangdacheng (Dacheng) wrote:
> So, I think it is proper to put the work mentioned above into an
> individual document. But if the group would like us to put the
> conclusion of our analysis into other documents or help the authors
> of other documents do the security related work, we would be very
> happy to do so. ^_^

My primary concern is that an implementer, etc. might read
the core documents and think that they can skip the security
document, if they're not security experts.  I do think the text
belongs in the main documents, with the authors of the security
considerations sections being named as co-authors on the
draft.  I think the text in this draftis quite good and I'd like
to see it folded into the main documents with credit given where
credit is due.

Melinda

---

From: Eric Gray <[email-masked]>
Date: Thu, 29 Aug 2013 17:49:22 +0000

Melinda,

	One advantage of having a single "Security Requirements" draft at this point is because
of the current goals of the working group - i.e. - to determine:

	o	What the problem is that the WG would like to see solved
	o	What the background/environment is in which the solution(s) need to work
	o	What the requirements are to accomplish this, and
	o	What is missing.

	As the editor of the "what is missing" draft, I find having a single security requirements
draft that defines the over-arching security needs in the problem space greatly superior to the
potential for a "security considerations" section in each of the other requirements drafts that
cannot really say much beyond "solutions intended to address the requirements defined in 
this document must include appropriate security considerations specific to the solution(s) they
provide."

	We don't want to use solutions documents that describe the security considerations
that apply to the solutions to determine what the security requirements are for the problem.

	There is a difference between "Security Requirements" and "Security Considerations"
as well.   They may sound similar, but they are not.

	Once the WG is re-chartered to provide specific solutions, the prior existence of a
"security requirements" document should provide an excellent guide to the folks writing the
"security considerations" sections of solution documents as to at least the high-level items to
discuss.

	I doubt that anyone is proposing the existence of a security requirements document
will excuse writers of other documents from including appropriate security considerations
specific to what their document(s) propose.

--
Eric

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Melinda Shore
Sent: Friday, August 23, 2013 1:22 PM
To: [email-masked]
Subject: Re: [nvo3] Poll for WG adoption of draft-hartman-nvo3-security-requirements-01

On 8/23/13 7:22 AM, Bocci, Matthew (Matthew) wrote:
> This email begins a two week poll to help the chairs determine if 
> there is consensus to adopt 
> draft-hartman-nvo3-security-requirements-01.txt as an NVO3 working group draft.

What's the reason for not incorporating this material into the other requirements drafts?  I think that the text is a good start but I am generally not that enthusiastic about moving security issues into separate documents unless there's a compelling reason.

Melinda