Subject: Re: [Pce] draft-ietf-pce-pceps-07 available

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Sun, 6 Mar 2016 20:08:23 +0000

Hi Tom,

Apologies for the delay (other urgent requests piling up…) Dhruv has just reminded me of this comment of yours. I think you are right: It is much better to maintain symmetry in the TLS verification and use a general term that includes both peers. I’ll upload an updated version right now.

Be goode,

On 3 Feb 2016, at 18:06 , t.petch <[email-masked]<mailto:[email-masked]>> wrote:

Diego

Looks good with one slight query.  I commented before on the use of
'client' in s.3.5 which suggested an asymmetric protocol, where the PCE
checks on the PCC needed to be more stringent that those of the PCC on
the PCE.  I notice that one of the 'client' has gone but one has not and
there is still a 'PCC' in there so it still to me carries the flavour
that PCE checking of the PCC is more important than the other way round.
I do not know if this is ok or not, how it lines up with the threat
model.

Tom Petch

----- Original Message -----
From: "DIEGO LOPEZ GARCIA" <[email-masked]<mailto:[email-masked]>>
To: <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, January 21, 2016 2:07 PM

Hi,

We have just uploaded a new version of draft-ietf-pce-pceps
(https://datatracker.ietf.org/doc/draft-ietf-pce-pceps/)

We believe this new version addresses all the comments received from the
SECDIR review after the last call period, and other pending ones
provided by Tom while that SECDIR review was taking place. As far as the
authors can say, the document is ready to progress.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Sun, 6 Mar 2016 20:18:43 +0000

Hi again,

I forgot to mention that we’ll change the mention to “client” and “client certificate” in the third paragraph of 3.5. But the mention to PCC in the discussion of the use of DANE has to remain, as DANE is mentioned in the context of DNS discovery, that is only applicable by a PCC.

Be goode,

On 6 Mar 2016, at 21:08 , DIEGO LOPEZ GARCIA <[email-masked]<mailto:[email-masked]>> wrote:

Hi Tom,

Be goode,

Diego

Tom Petch

----- Original Message -----
From: "DIEGO LOPEZ GARCIA" <[email-masked]<mailto:[email-masked]>>
To: <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, January 21, 2016 2:07 PM

Hi,

Be goode,

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]<mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]<mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição
_______________________________________________
Pce mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/pce

Dr Diego R. Lopez
Telefonica I+D

---

From: t.petch <[email-masked]>
Date: Tue, 8 Mar 2016 10:29:31 +0000

Diego,

Yes, understand the logic but (ducking) it was
"  In addition, a PCC MAY apply the procedures described in [RFC6698]"
and is now
"  In addition, a PCV MAY apply the procedures described in [RFC6698]"

Separately (why can't I get it right first time?), your MTI ciphersuites
are defined in RFC5288 which I think should be a Normative Reference
from s.3.4

Tom Petch

----- Original Message -----
From: "DIEGO LOPEZ GARCIA" <[email-masked]>
To: "t.petch" <[email-masked]>
Cc: <[email-masked]>
Sent: Sunday, March 06, 2016 8:18 PM

> Hi again,
>
> I forgot to mention that we’ll change the mention to “client” and
“client certificate” in the third paragraph of 3.5. But the mention to
PCC in the discussion of the use of DANE has to remain, as DANE is
mentioned in the context of DNS discovery, that is only applicable by a
PCC.
>
> Be goode,
>
> On 6 Mar 2016, at 21:08 , DIEGO LOPEZ GARCIA
<[email-masked]<mailto:[email-masked]>>
wrote:
>
> Hi Tom,
>
> Apologies for the delay (other urgent requests piling up…) Dhruv has
just reminded me of this comment of yours. I think you are right: It is
much better to maintain symmetry in the TLS verification and use a
general term that includes both peers. I’ll upload an updated version
right now.
>
> Be goode,
>
> On 3 Feb 2016, at 18:06 , t.petch
<[email-masked]<mailto:[email-masked]>> wrote:
> From: "DIEGO LOPEZ GARCIA"
<[email-masked]<mailto:[email-masked]>>
> e-mail:
[email-masked]<mailto:[email-masked]>
> e-mail:
[email-masked]<mailto:[email-masked]>
> Este mensaje y sus adjuntos se dirigen exclusivamente a su
destinatario, puede contener información privilegiada o confidencial y
es para uso exclusivo de la persona o entidad de destino. Si no es
usted. el destinatario indicado, queda notificado de que la lectura,
utilización, divulgación y/o copia sin autorización puede estar
prohibida en virtud de la legislación vigente. Si ha recibido este
mensaje por error, le rogamos que nos lo comunique inmediatamente por
esta misma vía y proceda a su destrucción.
>
> The information contained in this transmission is privileged and
confidential information intended only for the use of the individual or
entity named above. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this communication is strictly prohibited. If you have
received this transmission in error, do not read it. Please immediately
reply to the sender that you have received this communication in error
and then delete it.
>
> Esta mensagem e seus anexos se dirigem exclusivamente ao seu
destinatário, pode conter informação privilegiada ou confidencial e é
para uso exclusivo da pessoa ou entidade de destino. Se não é vossa
senhoria o destinatário indicado, fica notificado de que a leitura,
utilização, divulgação e/ou cópia sem autorização pode estar proibida em
virtude da legislação vigente. Se recebeu esta mensagem por erro,
rogamos-lhe que nos o comunique imediatamente por esta mesma via e
proceda a sua destruição
> Este mensaje y sus adjuntos se dirigen exclusivamente a su
destinatario, puede contener información privilegiada o confidencial y
es para uso exclusivo de la persona o entidad de destino. Si no es
usted. el destinatario indicado, queda notificado de que la lectura,
utilización, divulgación y/o copia sin autorización puede estar
prohibida en virtud de la legislación vigente. Si ha recibido este
mensaje por error, le rogamos que nos lo comunique inmediatamente por
esta misma vía y proceda a su destrucción.
>
> The information contained in this transmission is privileged and
confidential information intended only for the use of the individual or
entity named above. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this communication is strictly prohibited. If you have
received this transmission in error, do not read it. Please immediately
reply to the sender that you have received this communication in error
and then delete it.
>
> Esta mensagem e seus anexos se dirigem exclusivamente ao seu
destinatário, pode conter informação privilegiada ou confidencial e é
para uso exclusivo da pessoa ou entidade de destino. Se não é vossa
senhoria o destinatário indicado, fica notificado de que a leitura,
utilização, divulgação e/ou cópia sem autorização pode estar proibida em
virtude da legislação vigente. Se recebeu esta mensagem por erro,
rogamos-lhe que nos o comunique imediatamente por esta mesma via e
proceda a sua destruição

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Tue, 8 Mar 2016 23:22:39 +0000

Hi Tom,

(what are you going to leave for the shepherd and the RFC editors? :-))

The PCC/PCV mistake was caused by my fiddling with line breaks to make a more readable XML source when updating to -08. Good catch!

And you are right that RFC5288 should be mentioned in section 3.4, and among the normative references.

-09 on its way. I hope this will be the one able to progress…

Be goode,

On 8 Mar 2016, at 11:29 , t.petch <[email-masked]<mailto:[email-masked]>> wrote:

Diego,

Tom Petch

----- Original Message -----
From: "DIEGO LOPEZ GARCIA" <[email-masked]<mailto:[email-masked]>>
To: "t.petch" <[email-masked]<mailto:[email-masked]>>
Cc: <[email-masked]<mailto:[email-masked]>>
Sent: Sunday, March 06, 2016 8:18 PM

Hi again,

Be goode,

On 6 Mar 2016, at 21:08 , DIEGO LOPEZ GARCIA
<[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
wrote:

Hi Tom,

Be goode,

On 3 Feb 2016, at 18:06 , t.petch
<[email-masked]<mailto:[email-masked]><mailto:[email-masked]>> wrote:

Diego

Looks good with one slight query.  I commented before on the use of
'client' in s.3.5 which suggested an asymmetric protocol, where the
PCE
checks on the PCC needed to be more stringent that those of the PCC on
the PCE.  I notice that one of the 'client' has gone but one has not
and
there is still a 'PCC' in there so it still to me carries the flavour
that PCE checking of the PCC is more important than the other way
round.
I do not know if this is ok or not, how it lines up with the threat
model.

Tom Petch

----- Original Message -----
From: "DIEGO LOPEZ GARCIA"
<[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
To: <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
Sent: Thursday, January 21, 2016 2:07 PM

Hi,

We believe this new version addresses all the comments received from
the
SECDIR review after the last call period, and other pending ones
provided by Tom while that SECDIR review was taking place. As far as
the
authors can say, the document is ready to progress.

Be goode,

Dr Diego R. Lopez
Telefonica I+D

e-mail:
[email-masked]<mailto:[email-masked]><mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

Dr Diego R. Lopez
Telefonica I+D

e-mail:
[email-masked]<mailto:[email-masked]><mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

[email-masked]<mailto:[email-masked]><mailto:[email-masked]>

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D

---

From: t.petch <[email-masked]>
Date: Thu, 10 Mar 2016 10:57:38 +0000

----- Original Message -----
From: "DIEGO LOPEZ GARCIA" <[email-masked]>
To: "t.petch" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, March 08, 2016 11:22 PM

> (what are you going to leave for the shepherd and the RFC editors?
:-))

Don't worry - I have left some quirks of grammar for them to find and I
am sure that someone will query the lack of 'Updates RFC5440' (I do not
think that this I-D does) or the references not being in numerical
order, while I expect some will see an incompatability between sections
1 and 3.2 regarding the TLS roles when PCE communicates with PCE
(answer - go read RFC5440!), while the Security ADs/Directorate always
find something to discuss that I would never notice.

So I would send this on its way as is - having one or two minor
editorial quirks in an I-D provides a good metric of the subsequent
reviews:-)

Tom Petch

> The PCC/PCV mistake was caused by my fiddling with line breaks to make
a more readable XML source when updating to -08. Good catch!
> On 8 Mar 2016, at 11:29 , t.petch
> On 6 Mar 2016, at 21:08 , DIEGO LOPEZ GARCIA
<[email-masked]<mailto:[email-masked]><mailt
o:[email-masked]>>
> On 3 Feb 2016, at 18:06 , t.petch
<[email-masked]<mailto:[email-masked]><mailto:ietfc@btconnect.
> From: "DIEGO LOPEZ GARCIA"
<[email-masked]<mailto:[email-masked]><mailt
o:[email-masked]>>
> authors can say, the document is ready to progress.
[email-masked]<mailto:[email-masked]><mailto
:[email-masked]>
> Mobile: +34 682 051 091
[email-masked]<mailto:[email-masked]><mailto
:[email-masked]>