Subject: [OPSAWG] Opsdir last call review of draft-mm-wg-effect-encrypt-13

From: Joe Clarke <[email-masked]>
Date: Wed, 29 Nov 2017 07:31:06 -0800

Reviewer: Joe Clarke
Review result: Has Nits

I have been requested to review draft-mm-wg-effect-encrypt for the ops
directorate.  This document describes the effects of pervasive encryption on
operators.  The document sets out a rather comprehensive list of network data
(in motion and at rest) use cases and explains how encryption will effect each
of them.  Overall, I feel this document is ready.  As someone that has
supported networks from a troubleshooting perspective for years, I was
especially pleased with the numerous callouts to troubleshooting impacts as
well as deficiencies in application logging.

To that end, it might be useful to specifically point out where vendors have a
role to fill in some of these areas to allow for transit encryption while
providing the necessary hooks for operators to manage and troubleshoot their
network.  Specifically, in many of the troubleshooting scenarios, operators
won't be able to provide truly useful tools to their end users unless the
vendors provide the right level of visibility.

On to some nits.

In section 1.1 you use "end user's" where I think you mean "end users'".

===

Section 2.  Today, Snowden is fairly well-known.  But as this document lives,
maybe the specifics of what he's done may get fuzzy.  Perhaps this could do
with a reference.

===

Sections 5.3 and 6.2: you reference the abbreviation SNI before formally
defining it.  It's more obvious in Section 6.2.

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 29 Nov 2017 11:21:24 -0500

Hello Joe,

First, thank you for your helpful review.

> vendors provide the right level of visibility.

Do you have suggested text that we could add to address this gap from
your experience?

> defining it.  It's more obvious in Section 6.2.

Thanks for catching the nits, we will address them.

Best regards,
Kathleen

-- 

Best regards,
Kathleen

---

From: Joe Clarke <[email-masked]>
Date: Thu, 30 Nov 2017 11:50:33 -0500

> Do you have suggested text that we could add to address this gap from

Maybe something along the lines of the following in Section 2.1.2 (or
maybe in a section of its own):

"Vendors must be aware that in order for operators to better
troubleshoot and manage networks with increasing amounts of encrypted
traffic, built-in diagnostics and serviceability must be enhanced to
provide detailed logging and debugging capabilities that, when possible,
can reveal cleartext network parameters.  In addition to traditional
logging and debugging methods, packet tracing and inspection along the
service path will provide operators the necessary visibility to continue
to diagnose problems reported both internally and by their customers."

Joe

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 30 Nov 2017 12:14:42 -0500

> to diagnose problems reported both internally and by their customers."

Thank you, Joe!

-- 

Best regards,
Kathleen