Subject: [tsvwg] Kathleen Moriarty's Discuss on draft-ietf-tsvwg-gre-in-udp-encap-18: (with DISCUSS)

From: "Kathleen Moriarty" <[email-masked]>
Date: Mon, 26 Sep 2016 07:49:12 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-tsvwg-gre-in-udp-encap-18: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tsvwg-gre-in-udp-encap/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This should be quick to resolve and may just need some clarifying text in
the draft.

I see section 5 has DTLS as a SHOULD and this is stated in the security
considerations as well, to be used when privacy and security of original
traffic is needed.  Section 5 says that DTLS is not needed when
encryption is addressed at another layer, is that the only case when it
is not needed?  If so, can that be made more clear in the document?  If
not, what other situations result in no need for DTLS?

Thank you,
Kathleen

---

From: Lucy yong <[email-masked]>
Date: Mon, 26 Sep 2016 17:01:06 +0000

Hi Kathleen,

Please see inline below.

-----Original Message-----
From: Kathleen Moriarty [mailto:[email-masked]] 
Sent: Monday, September 26, 2016 9:49 AM
To: The IESG
Cc: [email-masked]; David L. Black; [email-masked]; [email-masked]; [email-masked]
Subject: Kathleen Moriarty's Discuss on draft-ietf-tsvwg-gre-in-udp-encap-18: (with DISCUSS)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

This should be quick to resolve and may just need some clarifying text in the draft.

I see section 5 has DTLS as a SHOULD and this is stated in the security considerations as well, to be used when privacy and security of original traffic is needed.  Section 5 says that DTLS is not needed when encryption is addressed at another layer, is that the only case when it is not needed?  If so, can that be made more clear in the document?  If not, what other situations result in no need for DTLS?
[Lucy] This is not the only case. If applying GRE-in-UDP in an secured operator network, e.g., within an enterprise DC, use of DTLS may not be necessary. 

We can revise the last paragraph to:   DTLS can be used when a privacy and security of original traffic is a concern when it is delivered by a GRE-in-UDP tunnel. There are cases where use of GRE-in-UDP tunnel will not cause such concerns, e.g. the traffic to be encapsulated is already encrypted or the tunnel is used within a secure operation network only. Applying DTLS to GRE-in-UDP tunnel requires both tunnel end points to configure use of DTLS.

Thanks,
Lucy

Thank you,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 26 Sep 2016 13:17:21 -0400

Hi Lucy,

> https://datatracker.ietf.org/doc/draft-ietf-tsvwg-gre-in-udp-encap/

This helps, let me know when the text is updated to make it clear that
DTLS should be used except in those situations.

Thank you,
Kathleen

-- 

Best regards,
Kathleen

---

From: Lucy yong <[email-masked]>
Date: Mon, 26 Sep 2016 18:18:09 +0000

Hi Kathleen, 

This helps, let me know when the text is updated to make it clear that DTLS should be used except in those situations.
[Lucy1] OK, I see your point. The paragraph is just to give examples to justify the need of GRE-in-UDP without DTLS, so DTLS is an option to be used to secure original traffic. Operator may choose to use IPsec to secure original traffic for a reason. I am not sure if it is good to list all situations here and put "SHOULD use DTLS" otherwise. Any advice? 

Regards,
Lucy

Thank you,
Kathleen

-- 

Best regards,
Kathleen

---

From: [email-masked]
Date: Mon, 26 Sep 2016 14:26:01 -0400

Hi Lucy,

Please excuse typos, sent from handheld device 

> On Sep 26, 2016, at 2:18 PM, Lucy yong <[email-masked]> wrote:
> 
> Hi Kathleen, 
>> 
>> 

SHOULD is correct from what you are telling me, just adding the sentence you provided earlier in the security considerations and making it clear in section 5 as well would help.  This is just for clarity as it wasn't clear to me as written.

Thank you,
Kathleen

---

From: Lucy yong <[email-masked]>
Date: Mon, 26 Sep 2016 18:55:16 +0000

Here are the proposed new text to address Kathleen's concern.

The last paragraph in Section 5

OLD:
If the traffic to be encapsulated is already encrypted, it is
   usually not necessary to encrypt it again. Applying DTLS to GRE-in-
   UDP tunnel requires both tunnel end points to configure use of DTLS.
NEW:
DTLS SHOULD be used where a privacy and security of original traffic is a concern when it is delivered by a GRE-in-UDP tunnel. There are cases where use of GRE-in-UDP tunnel will not cause such concern, e.g., the traffic to be encapsulated is already encrypted or the tunnel is used within a secure operation network only. Applying DTLS to a GRE-in-UDP tunnel requires both tunnel end points to configure use of DTLS.

The second paragraph in Section 11

OLD:
To secure original traffic, DTLS SHOULD be used as specified in Section 5.
NEW:
To secure original traffic, a GRE-in-UDP tunnel with DTLS specified in Section 5 SHOULD be used.  

Kathleen: will these changes make clear to you?

Lucy
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Monday, September 26, 2016 1:26 PM
To: Lucy yong
Cc: The IESG; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: Kathleen Moriarty's Discuss on draft-ietf-tsvwg-gre-in-udp-encap-18: (with DISCUSS)

Hi Lucy,

Thank you,
Kathleen

---

From: [email-masked]
Date: Mon, 26 Sep 2016 15:01:10 -0400

> On Sep 26, 2016, at 2:55 PM, Lucy yong <[email-masked]> wrote:
> 

Thank you, Lucy.  This text is much better.

Best regards,
Kathleen