Subject: RE: [NSIS] AD Review comments on draft-ietf-nsis-req-07.txt

From: "Attila Bader (ETH)" <[email-masked]>
Date: Mon, 16 Jun 2003 16:27:47 +0200

Hi Allison,

I do not completely understand your argument for MUST implementation of hop-by-hop security. 'Must be implemented but not must use' means that there is the possibility to use hop-by-hop security in any NE but it has to be implemented even if it is never used. 'SHOULD be supported' means that it has to be implemented except in particular cases. I think it is strong enough. 

Best regards, Attila

> 
> 5.7.5 Hop-by-hop security 
>     
>    Hop-by-Hop security SHOULD be supported. It is a well known and 
>    proven concept in Quality-of-Service and other signaling protocols 
>    that allows intermediate nodes that actively participate in the 
>    protocol to modify the messages as it is required by processing 
>    rules. Note that this requirement does not exclude end-to-end or 
>    network-to-network security of a signaling message. End-to-end 
>    security between the initiator and the responder may be used to 
>    provide protection of non-mutable data fields. Network-to-network 
>    security refers to the protection of messages over various 
> hops but 
>    not in an end-to-end manner i.e. protected over a 
> particular network. 
> 
> Without minimum mandatory to implement channel security for 
> the signaling, 
> you can't be sure the other security features will be 
> untampered with -
> this needs to be a MUST implement (it's not a MUST use).  
> Suggest changing
> the first sentence to "Channel security between signaling entities
> MUST be implemented'?
> 
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Melinda Shore <[email-masked]>
Date: Mon, 16 Jun 2003 17:31:30 -0400

> I do not completely understand your argument for MUST
> implementation of hop-by-hop security. 'Must be
> implemented but not must use' means that there is the
> possibility to use hop-by-hop security in any NE but it
> has to be implemented even if it is never used. 'SHOULD be
> supported' means that it has to be implemented except in
> particular cases. I think it is strong enough.

"SHOULD be supported" does not mean what you say it means.

For practical purposes, if hop-by-hop security is a
must-implement, then failing to do so results in a
non-interoperable implementation.  If hop-by-hop security is
a should-implement, then failing to do so does not result in
a non-interoperable implementation.  Given the consequences
of a successful attack against this protocol, which could
range from dinking with QoS signaling (and all that implies)
to opening firewall pinholes to installing bogus address
maps in a NAT, it seems perfectly reasonable to have
mandatory-to-implement security mechanisms.

Melinda

---

From: "Georgios Karagiannis" <[email-masked]>
Date: Tue, 17 Jun 2003 10:18:49 +0200

Hi Melinda

> a non-interoperable implementation.

It depends where the hop-by hop security is implemented.
For example in one administrative domain (with trust relashionships between
NSIS peers)
 hop-by-hop security must be implemented on the NSIS edge nodes, without
requiring that hop-by-hop
security is  implemented in the NSIS interior nodes.

Best Regards,
Georgios

---

From: Melinda Shore <[email-masked]>
Date: Tue, 17 Jun 2003 07:39:29 -0400

> For example in one administrative domain (with trust
> relashionships between NSIS peers) hop-by-hop security
> must be implemented on the NSIS edge nodes, without
> requiring that hop-by-hop security is implemented in the
> NSIS interior nodes.

That's optional-to-use, not optional-to-implement.

Melinda