Subject: [Dots] Éric Vyncke's No Objection on draft-ietf-dots-architecture-16: (with COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Mon, 03 Feb 2020 02:18:47 -0800

Éric Vyncke has entered the following ballot position for
draft-ietf-dots-architecture-16: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dots-architecture/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Dear authors,

Thank you for the work put into this document. As a side note, I really liked
the section about the manual/over-the-phone part of it.

Until now, I have read only this document (dots-architecture) from the dots WG,
so, please accept my ignorance for details. But, I have a couple of
non-blocking questions where your reply will be welcome and appreciated:

Q1) is the monetary cost part of the DOTS signaling ? (I.e., the mitigator
telling the target that it will cost so many EUR per hour)

Q2) Using DOTS in an under-attack network, did you consider recommending
dual-stack signaling to cope with the rare case where IPv4 is disrupted while
IPv6 still works (of course if the DoS is plain flooding this won't help a lot
probably; and the dual proposition exists).

Q3) While I appreciate the value of Anycast DOTS server, hence UDP is mostly
required for signaling transport, I wonder whether the choice of UDP (often
used AFAIK as volumetric attack as it is easier to spoof) is a good choice
compared to TCP or DSCP or ...

Q4) When having multiple DOTS servers, I assume that the case of a dual-stack
DOTS server is also covered. Therefore, a word on whether Happy Eyeball (RFC
8305) should probably be useful **IF** applicable

Regards

-éric

Regards,

-éric

---

From: tirumal reddy <[email-masked]>
Date: Tue, 4 Feb 2020 08:42:26 +0530

Hi Eric,

Thanks for the review. Please see inline

> https://datatracker.ietf.org/doc/draft-ietf-dots-architecture/

No, monetary cost is not part of the DOTS signaling.

> probably; and the dual proposition exists).

Yes, Happy Eyeballs for DOTS signal channel is discussed in
https://tools.ietf.org/html/draft-ietf-dots-signal-channel-41#section-4.3

> compared to TCP or DSCP or ...

Both DTLS over UDP and TLS over TCP is used by the DOTS signal channel (UDP
is given higher precedence than TCP).
DTLS is capable of defending against DoS attack by using the stateless
cookie mechanism (see https://tools.ietf.org/html/rfc6347#section-4.2.1)

> 8305) should probably be useful **IF** applicable

Happy Eyeball is discussed in detail in the DOTS signal channel protocol
specification.

Cheers,
-Tiru

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Tue, 4 Feb 2020 06:58:02 +0000

Tiru,

Thank you for the prompt reply.

My comments/questions were not blocking but I appreciate your reply.

Regards

-éric

From: iesg <[email-masked]> on behalf of tirumal reddy <[email-masked]>
Date: Tuesday, 4 February 2020 at 04:13
To: Eric Vyncke <[email-masked]>
Cc: Roman Danyliw <[email-masked]>, Valery Smyslov <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, The IESG <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: Éric Vyncke's No Objection on draft-ietf-dots-architecture-16: (with COMMENT)

Hi Eric,

On Mon, 3 Feb 2020 at 15:48, Éric Vyncke via Datatracker <[email-masked]<mailto:[email-masked]>> wrote:
Éric Vyncke has entered the following ballot position for
draft-ietf-dots-architecture-16: No Objection

Dear authors,

Yes, Happy Eyeballs for DOTS signal channel is discussed in https://tools.ietf.org/html/draft-ietf-dots-signal-channel-41#section-4.3

Both DTLS over UDP and TLS over TCP is used by the DOTS signal channel (UDP is given higher precedence than TCP).
DTLS is capable of defending against DoS attack by using the stateless cookie mechanism (see https://tools.ietf.org/html/rfc6347#section-4.2.1)

Happy Eyeball is discussed in detail in the DOTS signal channel protocol specification.

Cheers,
-Tiru

Regards

-éric

Regards,

-éric