Subject: [pcp] Tiru's comment about CHECKPOINT_REQUIRED option draft

From: <[email-masked]>
Date: Thu, 28 Aug 2014 06:29:47 +0000

Hi Tiru,

You raised a comment during the interim meeting about CHECKPOINT_REQUIRED option. 

Below a text proposal that tries to capture your comment:

   CHECKPOINT_REQUIRED option can be used by an attacker to identify
   critical flows.  This issue can be softened in environments where the
   network infrastructure between the PCP client and the server are
   under the responsibility of a single administrative domain.  If the
   networking environment between the PCP client and PCP server is not
   secure, means to protect exposing the content of PCP messages are
   recommended.

Please let us know if this text reflects your point. 

Thank you.

Cheers,
Med

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 28 Aug 2014 08:13:35 +0000

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]
> Sent: Thursday, August 28, 2014 12:00 PM
> To: Tirumaleswar Reddy (tireddy)
> Cc: [email-masked]
> Subject: Tiru's comment about CHECKPOINT_REQUIRED option draft
> 
> Hi Tiru,
> 
>    under the responsibility of a single administrative domain.  

Even in single administrative domain internal attacks are possible. 
Now a days the number of internal attacks are growing in Enterprise networks.

>   If the

Agreed. CHECKPOINT_REQUIRED could be propagated by the PCP proxy to the PCP server in the ISP and will cross administrative domains. It will be good to explain the behavior of CHECKPOINT_REQUIRED in presence of PCP proxy. I am thinking of proposing PCP over DTLS that would help both this document and draft-wing-pcp-flowdata-00 to provide confidentiality.

-Tiru

---

From: <[email-masked]>
Date: Thu, 28 Aug 2014 08:27:05 +0000

Re-,

Here is an update of the proposed text based on your input:

   CHECKPOINT_REQUIRED option can be used by an attacker to identify
   critical flows.  This issue is mitigated if the network on which the
   PCP messages are to be sent is fully trusted.  Means to defend
   against attackers who can intercept packets between the PCP server
   and the PCP client should be enabled.  In some deployments, access
   control lists (ACLs) can be installed on the PCP client, PCP server,
   and the network between them, so those ACLs allow only communications
   between trusted PCP elements.  If the networking environment between
   the PCP client and PCP server is not secure, means to protect
   exposing the content of PCP messages (e.g., DTLS [RFC6347]) are
   recommended.

Better?

Cheers,
Med

>-----Message d'origine-----
>De : Tirumaleswar Reddy (tireddy) [mailto:[email-masked]]
>Envoyé : jeudi 28 août 2014 10:14
>À : BOUCADAIR Mohamed IMT/OLN
>Cc : [email-masked]
>Objet : RE: Tiru's comment about CHECKPOINT_REQUIRED option draft
>
>Agreed. CHECKPOINT_REQUIRED could be propagated by the PCP proxy to the PCP
>server in the ISP and will cross administrative domains. It will be good to
>explain the behavior of CHECKPOINT_REQUIRED in presence of PCP proxy. I am
>thinking of proposing PCP over DTLS that would help both this document and
>draft-wing-pcp-flowdata-00 to provide confidentiality.
>
>-Tiru
>>

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 28 Aug 2014 08:32:56 +0000

> Sent: Thursday, August 28, 2014 1:57 PM
> Subject: RE: Tiru's comment about CHECKPOINT_REQUIRED option draft
> 
> Re-,
> 

Looks good.

-Tiru

> >De : Tirumaleswar Reddy (tireddy) [mailto:[email-masked]] Envoyé :
> >jeudi 28 août 2014 10:14 À : BOUCADAIR Mohamed IMT/OLN Cc :
> >[email-masked] Objet : RE: Tiru's comment about CHECKPOINT_REQUIRED
> >option draft
> >
> >Agreed. CHECKPOINT_REQUIRED could be propagated by the PCP proxy to
> the
> >PCP server in the ISP and will cross administrative domains. It will be
> >good to explain the behavior of CHECKPOINT_REQUIRED in presence of PCP
> >proxy. I am thinking of proposing PCP over DTLS that would help both
> >this document and

---

From: <[email-masked]>
Date: Thu, 28 Aug 2014 09:39:35 +0000

Ok, thanks. 

This will be included in the next revision.

Cheers,
Med

>Envoyé : jeudi 28 août 2014 10:33