Subject: [Int-area] Kathleen Moriarty's No Objection on draft-ietf-intarea-gre-ipv6-11: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Tue, 04 Aug 2015 13:35:43 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-intarea-gre-ipv6-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-intarea-gre-ipv6/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

The draft looks good, but I do have one item to chat about that should be
very easy to address.  Its subtle wording, but I think it is important. 
Thanks.

Surprisingly, RFC4023 does a pretty good job explaining the threats that
IPsec encryption and authentication help mitigate.  The wording in the
security section of this draft reads to me as if you can use either
encryption or authentication to address those threats.  I'm pretty sure
that was not intended as each assists to mitigate different threats,
clearly described in RFC4023.

The Security Considerations has the following text right now:
   These threats apply to
   any GRE payload.  As stated in RFC 4023, these threats can be
   mitigated by authenticating and/or encrypting the delivery packet
   using IPsec [RFC4301].  Alternatively when the payload is IPv6, these
   threats can also be mitigated by authenticating and/or encrypting the
   payload using IPsec, instead of the delivery packet. 

How about something like the following (feel free to propose something
else):
  These threats apply to
   any GRE payload.  As stated in RFC 4023, the various threats can be
   mitigated through options such as authenticating and/or encrypting the
delivery packet
   using IPsec [RFC4301].  Alternatively when the payload is IPv6, these
   threats can also be mitigated by authenticating and/or encrypting the
   payload using IPsec, instead of the delivery packet. 

If it is changed in the first sentence, I think it makes the second one
follow a bit better without changes.

---

From: Ronald Bonica <[email-masked]>
Date: Wed, 5 Aug 2015 16:36:20 +0000

Hi Kathleen,

Thanks for the text and careful review. I will spin a new version with your proposed text before the draft is approved.

                                                                                  Ron

> -----Original Message-----
> From: Kathleen Moriarty [mailto:[email-masked]]
> Sent: Tuesday, August 04, 2015 4:36 PM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; draft-ietf-intarea-gre-
> [email-masked]; [email-masked];
> [email-masked]; [email-masked]; [email-masked]
> Subject: Kathleen Moriarty's No Objection on draft-ietf-intarea-gre-ipv6-11:
> (with COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> Surprisingly, RFC4023 does a pretty good job explaining the threats that IPsec
> encryption and authentication help mitigate.  The wording in the security
> section of this draft reads to me as if you can use either encryption or
> authentication to address those threats.  I'm pretty sure that was not
> intended as each assists to mitigate different threats, clearly described in
> RFC4023.
> 
> If it is changed in the first sentence, I think it makes the second one follow a
> bit better without changes.
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 5 Aug 2015 13:13:15 -0400

Thank you, Ron.

Sent from my iPhone

> On Aug 5, 2015, at 12:36 PM, Ronald Bonica <[email-masked]> wrote:
> 
> Hi Kathleen,
>

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Thu, 6 Aug 2015 10:02:04 +0000

Kathleen,

> On Aug 4, 2015, at 10:35 PM, Kathleen Moriarty <[email-masked]> wrote:
> 

I like this proposal. Flows better — thanks!

— Carlos.