Subject: Re: [NSIS] Req-Draft: Open Issue 4: Confidentiality of signaling messages

From: Bob Braden <[email-masked]>
Date: Mon, 4 Nov 2002 17:59:27 GMT

*> 
  *> 
  *> Req-Draft: Open Issue 4: Confidentiality of signaling messages
  *> ---------------------------------------------------
  *> 
  *> Proposal to change Req 5.7.8
  *> "The NSIS protocol MUST allow encryption of NSIS messages between NSIS 
  *> nodes."
  *> 
Marcus,

I suspect that this is what "MAY be provided" was intended to mean, but
I agree that your proposed restatemnt is much clearer, and I support it.

Bob Braden

  *> Currently it says
  *> 
  *> 5.7.8 Confidentiality of signaling messages
  *> 
  *> Based on the signaling information exchanged between nodes participating in 
  *> the signaling protocol an adversary may learn both the identities and the 
  *> content of the signaling messages. To prevent this from happening, 
  *> confidentiality of the signaling message in a hop-by-hop manner MAY be 
  *> provided. Note that the protection can be provided on a hop-by-hop basis 
  *> for most message payloads since it is required that entities which actively 
  *> participating in the signaling protocol must be able to read and eventually 
  *> modify the content of the signaling messages."
  *> 
  *> --------------------------------------
  *> Dr. Marcus Brunner
  *> Network Laboratories
  *> NEC Europe Ltd.
  *> 
  *> E-Mail: [email-masked]
  *> WWW:    http://www.ccrle.nec.de/
  *> Phone: +49 (0) 6221 905 11 29
  *> personal home page: http://www.brubers.org/marcus
  *> 
  *> 
  *> _______________________________________________
  *> nsis mailing list
  *> [email-masked]
  *> https://www1.ietf.org/mailman/listinfo/nsis
  *> 
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: [email-masked]
Date: Tue, 5 Nov 2002 08:53:25 +0200

Hi Hannes,

> i would agree to a stronger requirement for confidentiality 
> protection of signaling messages.
> 
> how about:
> 
> "NSIS signaling messages MUST be confidentiality protected 
> between NSIS nodes."

Slight tweak:

 "NSIS signaling messages MUST be possible to be confidentiality 
                                  ^^^^^^^^^^^^^^ 
 protected between NSIS nodes."

John

---

From: "Hancock, Robert" <[email-masked]>
Date: Tue, 5 Nov 2002 08:53:13 -0000

Hi all,

I think there is a general point about several of these requirements, in that at this stage we could be saying (e.g. for a MUST)
*) mandatory to SPECIFY in the protocol definition, or
*) mandatory to IMPLEMENT in an implementation of it, or
*) mandatory to USE in a deployment of an implementation

Is it useful to draw this distinction more formally somehow? Or is everything clearly only SPECIFY at this stage (and the rest depends on what the protocol ends up being?)

robert h.

> -----Original Message-----
> From: Geib, Ruediger [mailto:[email-masked]]
> Sent: 05 November 2002 08:14
> To: [email-masked]
> Cc: [email-masked]
> Subject: RE: [NSIS] Req-Draft: Open Issue 4: Confidentiality of
> signaling messages
> 
> 
> Hannes,
> 
> I agree with Bob that encryption of signaling messages 
> is an option, not a requirement. A security mechanism 
> I'd like to see is a digest added to a message. That's 
> message integrity, I assume as non security expert, 
> and therefore another thread.
> 
> Regards, Rüdiger  
> 
> > > Req-Draft: Open Issue 4: Confidentiality of signaling messages
> > > ---------------------------------------------------
> > >
> > > Proposal to change Req 5.7.8
> > > "The NSIS protocol MUST allow encryption of NSIS messages 
> > between NSIS
> > > nodes."
> > >
> > > Currently it says
> > >
> > > 5.7.8 Confidentiality of signaling messages
> > >
> > > Based on the signaling information exchanged between nodes
> > > participating in the signaling protocol an adversary may
> > > learn both the identities and the content of the signaling
> > > messages. To prevent this from happening,
> > > confidentiality of the signaling message in a hop-by-hop 
> > > manner MAY be provided. Note that the protection can be
> > > provided on a hop-by-hop basis for most message payloads
> > > since it is required that entities which actively
> > > participating in the signaling protocol must be able to
> > > read and eventually
> > > modify the content of the signaling messages."
>

---

From: Bob Braden <[email-masked]>
Date: Tue, 5 Nov 2002 19:29:36 GMT

*> 
  *> Hi all,
  *> 
  *> I think there is a general point about several of these requirements, in that at this stage we could be saying (e.g. for a MUST)
  *> *) mandatory to SPECIFY in the protocol definition, or
  *> *) mandatory to IMPLEMENT in an implementation of it, or
  *> *) mandatory to USE in a deployment of an implementation
  *> 
  *> Is it useful to draw this distinction more formally somehow? Or is everything clearly only SPECIFY at this stage (and the rest depends on what the protocol ends up being?)
  *> 
  *> robert h.
  *> 
Robert,

I believe that the purpose of the requirements document requested by
the ADs is to define the requirements for the protocol spcification.
That rules out the second and third of your categories.

The second category, IMPLEMENT, would come in an Applicability
Statement document (which has often been called a "requirements"
document too, somewhat confusingly).  In practice, however, many
protocol specs include applicability statements interleaved with the
technical specification.

The IETF clearly has nothing to say about USE.

Bob Braden

---

From: "Georgios Karagiannis (ELN)" <[email-masked]>
Date: Fri, 8 Nov 2002 10:34:35 +0100

Hi all 

I agree with Melinda that encryption, and in general
security issues, could be seen as application layer 
functionality.
This is also applied in the draft:
http://www.ietf.org/internet-drafts/draft-westberg-proposal-for-rsvpv2-01.txt

Best regards,
Georgios

-----Original Message-----
From: Melinda Shore [mailto:[email-masked]]
Sent: woensdag 6 november 2002 16:30
To: Geib, Ruediger
Cc: [email-masked]; [email-masked]
Subject: Re: [NSIS] Req-Draft: Open Issue 4: Confidentiality of
signaling messages 

> To me, a simple relay doesn't have to operate encryption.

The correct answer to any technical question is "it
depends," and I think it this case it comes down to
depending on how the application layer is split from the
transport layer, what information is contained in the
transport layer, and if the information that a relay would
need to forward the message correctly is itself encrypted.

My suspicion is that the information one might want to
protect from prying eyes will tend to be carried in the
application, and that any information that could be derived
from looking at transport layer daya could also be derived
from traffic analysis.

Melinda

---

From: "Hancock, Robert" <[email-masked]>
Date: Fri, 8 Nov 2002 11:36:38 -0000

hi,
> hi ruediger
> 
> if the relay is nsis aware then it terminates security. to 
> forward signaling
> messages to another node it again has to provide security 
> processing. hence
> it acts a regular nsis node. whether it actually performs for 
> example qos
> reservation is not relevant for nsis.

or at least, not relevant to the NTLP (I think).

r.