Subject: [trill] draft-ietf-trill-o-pw comments

From: Erik Nordmark <[email-masked]>
Date: Mon, 25 Nov 2013 09:37:04 -0800

I've reviewed the document before writing up the PROTO.
A few requests for clarifications.

The two packet formats include a specific bit pattern:
       |      PPP Header 0x005d        |  2 octets

       |      PPP Header 0x405d        |  2 octets

For the un-initiated it would make sense to add a reference in the text 
below the figures. Something like "The PPP Header (0x005d and 0x405d 
respectively) is the header for data frames and IS-IS packets as 
specified in RFC XXX". (Or something in that vein.)

In security considerations we have
    For security considerations introduced by carrying PPP TRILL links
    over pseudowires, see [RFC3985].
I assume RFC 3985 doesn't talk about TRILL - but about PPP in general. 
Thus it would be more clear if we drop "TRILL" from that sentence.

The 3rd paragraph starts with
    Not all implementations need to include specific security mechanisms
    at the pseudowire layer ...
Is this a relaxation of the general PW security requirements? Or merely 
re-stating the stance for security for PW? It would make sense to spell 
that out in the document.

    Erik

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 26 Nov 2013 16:52:04 -0500

Hi Erik,

Replying as an author:

On Mon, Nov 25, 2013 at 12:37 PM, Erik Nordmark <[email-masked]> wrote:
> respectively) is the header for data frames and IS-IS packets as specified
> in RFC XXX". (Or something in that vein.)

OK.

> I assume RFC 3985 doesn't talk about TRILL - but about PPP in general. Thus
> it would be more clear if we drop "TRILL" from that sentence.

Actually, RFC 3985 is not PPP specific but talks about the risks
generally introduced by sending protocols that previously assumed a
local point-to-point link on a pseudo wire built on a packet switched
network. So I suggest replacing

"For security considerations introduced by carrying PPP TRILL links
over pseudowires, see [RFC3985]."
   with
"For security considerations introduced by carrying PPP TRILL links
over pseudowires, see [RFC3985] which discusses the risks introduced
by sending protocols that previously assumed a point-to-point link on
a pseudo wire built on a packet switched network (PSN)."

> re-stating the stance for security for PW? It would make sense to spell that
> out in the document.

That paragraph is an edit of the following paragraph that appears in
the Security Considerations section of RFC 6361 on TRILL over PPP:

   Not all implementations need to include specific security mechanisms
   at the PPP layer, for example if they are designed to be deployed
   only in cases where the networking environment is trusted or where
   other layers provide adequate security.  A complete enumeration of
   possible deployment scenarios and associated threats and options is
   not possible and is outside the scope of this document.  For
   applications involving sensitive data, end-to-end security should
   always be considered in addition to link security to provide security
   in depth.

I think the paragraph is just talking about the range of security
environments and PWE3 TRILL transport uses, that in some cases you
don't need to worry so much about it while in others you should also
be using end station to end station security no matter how good you
think your PWE3 security is. I also think it would be better if "...
implementations need to include ..." was replaced by "... deployments
need to use ..." or something like that.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 26 Nov 2013 14:42:52 -0800

> a pseudo wire built on a packet switched network (PSN)."

Works for me.

>     always be considered in addition to link security to provide security

For clarity I think it makes sense adding a reference to RFC 6361 with 
something like
	Just like in RFC 6361, not all ...

It probably makes sense to separate out the last added sentence ("In 
this context, such end-to-end security should
    be between the end stations involved so as to protect the entire path
    to, through, and from the TRILL campus") into a separate paragraph.

That hopeful makes it more clear to the security folks what is new and 
different.

Thanks,
    Erik

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 26 Nov 2013 17:47:52 -0500

>>> that
> It probably makes sense to separate out the last added sentence ("In this
> context, such end-to-end security should

OK.

Thanks,
Donald