Subject: Re: [bfcpbis] Kathleen Moriarty's Discuss on draft-ietf-bfcpbis-rfc4582bis-13: (with DISCUSS and COMMENT)

From: Alissa Cooper <[email-masked]>
Date: Fri, 11 Sep 2015 09:58:18 -0700

Adding Paul to this thread as he will helping to resolve comments on this draft.

> On Mar 5, 2015, at 7:22 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-bfcpbis-rfc4582bis-13: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-bfcpbis-rfc4582bis/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> Thanks for your work on this draft, it was very well written which is
> much appreciated.
> 
> I just have one item I'd like to discuss that should be very easy to
> resolve.  
> This should be considered with Spencer's question on what happens when
> the fragments are larger or smaller than the path MTU.  It's important to
> state this to prevent fragmentation overlap attacks (unless you can
> explain why we don't need to worry about that).
> 
> In the second sentence on page 42, adding the ending clause may be
> helpful:
>  The size of each of these N messages MUST be
>   smaller than the path MTU to help prevent fragmentation overlap
> attacks.
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> 
> Spencer asked what happens when TLS/DTLS is not used, so perhaps
> rewording of the intro to the security considerations section would help
> to clear up his point.  TLS/DTLS is the MTI with flexibility left in to
> support some other undefined mechanism to secure the channel.  Since no
> MTU is set, but recommended, the first few sentences are a bit confusing.
> The rest of the paragraph is clear in terms of MTI and recommendations
> when TLD/DTLS is used as well as alternates options supporting the listed
> desired security properties.
> 
> Security Considerations
> 
>   BFCP uses TLS/DTLS to provide mutual authentication between clients
>   and servers.  TLS/DTLS also provides replay and integrity protection
>   and confidentiality.
> 
>

---

From: "Paul E. Jones" <[email-masked]>
Date: Wed, 23 Sep 2015 06:26:54 +0000

Kathleen,

Following up on this email (and building a growing to-do list)....

------ Original Message ------
From: "Kathleen Moriarty" <[email-masked]>
To: "The IESG" <[email-masked]>
Cc: [email-masked]; 
[email-masked]; [email-masked]; 
[email-masked]
Sent: 3/5/2015 10:22:02 AM
Subject: [bfcpbis] Kathleen Moriarty's Discuss on 
draft-ietf-bfcpbis-rfc4582bis-13: (with DISCUSS and COMMENT)

>Please refer to 
>http://www.ietf.org/iesg/statement/discuss-criteria.html

Are you concerned about IP-packet level fragmentation overlap or payload 
level fragmentation overlap issues?  I think the former should be 
addressed with "do not fragment IP packets".  The latter is an area that 
is not addressed in the spec at present.  However, if there is overlap 
in the application data, I do not see any harm.  Of course, it would be 
important to check to ensure lengths are all correct to prevent buffer 
overruns.

Am I missing something here?

>    smaller than the path MTU to help prevent fragmentation overlap

This would be a good addition.  We have other text we need to add re: 
path MTU and it is the intent that all messages fit within the path MTU.

At present, TLS/DTLS are recommended, but not mandatory.  Without them, 
there is a host of attacks one could perform against either a client or 
server, especially over UDP, and there is no authentication or 
confidentiality.  Much of that is spelled out in the security 
considerations section.

I apologize, but I'm missing what your request is here.  Can you clarify 
for me?

Paul

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 23 Sep 2015 11:07:32 -0400

Hi Paul,

I think we are close, thanks for your response.  Inline.

On Wed, Sep 23, 2015 at 2:26 AM, Paul E. Jones <[email-masked]> wrote:
> Cc: [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> level fragmentation overlap issues?  I think the former should be addressed
> with "do not fragment IP packets".  The latter is an area that is not
> addressed in the spec at present.  However, if there is overlap in the
> application data, I do not see any harm.  Of course, it would be important
> to check to ensure lengths are all correct to prevent buffer overruns.
>

I think we are good with the agreed text below on this point.
> This would be a good addition.  We have other text we need to add re: path
> MTU and it is the intent that all messages fit within the path MTU.

Thanks, please let me know when this has been added to the draft and
I'll clear.  I see a -14 was posted, but don't see this text and could
have missed it.  If so, a pointer would be helpful.

> confidentiality.  Much of that is spelled out in the security considerations
> section.

Aren't they mandatory to implement (MTI), but not mandatory to use
(MTU)?    The "recommended" in the security considerations , I thought
could go further since you have an MTI, no?  The request would be a
slight rewording of the introduction or an explanation of why
recommended is appropriate even though there is an MTI.  In full
disclosure, I read this in full when the discuss was placed, but just
skimmed the applicable sections this time, so I may have missed
something.

Thanks,
Kathleen

>
> I apologize, but I'm missing what your request is here.  Can you clarify for
> me?
>
> Paul
>

-- 

Best regards,
Kathleen

---

From: "Paul E. Jones" <[email-masked]>
Date: Wed, 23 Sep 2015 21:38:07 +0000

Kathleen,

>>path

I have this in a very long list of to-do items, but it's not in the 
current draft.  I'll also add to that list to notify you when we publish 
a revision with that text.

Paul

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 23 Sep 2015 19:25:25 -0400

Sent from my iPhone

> On Sep 23, 2015, at 5:38 PM, Paul E. Jones <[email-masked]> wrote:
> 
> Kathleen,
> 
> I have this in a very long list of to-do items, but it's not in the current draft.  I'll also add to that list to notify you when we publish a revision with that text.

Thank you!