Subject: [rmcat] RMCAT security considerations: [I-D.ietf-rmcat-eval-criteria-08] [draft-ietf-rmcat-eval-test-07]

From: G Fairhurst <[email-masked]>
Date: Thu, 08 Nov 2018 12:31:20 +0700

I suggest you break the para into multiple parts.

I think need to discuss feedback saftery or at least mention this in CC 
drafts.

I would cite BCP41, to explain collapse.

OLD:
The evaluations of the test cases are intended to run in a controlled 
lab environment. Hence, the applications, simulators and network nodes 
should be well-behaved and should not impact the desired results. In 
case the evaluations are not done in a controlled environment, the 
security considerations in [I-D.ietf-rmcat-eval-criteria] and the 
relevant congestion control algorithms apply. It is important to take 
appropriate caution to avoid leaking non-responsive traffic from 
unproven congestion avoidance techniques onto the open Internet.

NEW:
The security considerations in [I-D.ietf-rmcat-eval-criteria] and the 
relevant congestion control algorithms apply. The principles for 
congestion control are described in BCP41 [RFC2914], and in particular 
any new method MUST implement safeguards to avoid congestion collapse of 
the Internet.

The evaluation of the test cases are intended to be run in a controlled 
lab environment. Hence, the applications, simulators and network nodes 
ought to be well-behaved and should not impact the desired results. It 
is important to take appropriate caution to avoid leaking non-responsive 
traffic from unproven congestion avoidance techniques onto the open 
Internet.

An attacker that could modify or spoof congestion control feedback 
packets might be able to manipulate the sender behaviour to cause denial 
of service.  This can be prevented by authentication and integrity 
protection of feedback packets. For example using the secure RTP profile 
[RFC3711][RFC5124] for RTP packets, or by other means as discussed in 
[RFC7201].
---

I really also did expect to see security considerations in:
  https://tools.ietf.org/html/draft-ietf-rmcat-eval-criteria-08
- These may be very similar test listed above? ... otherwise what is the 
purpose of this citation?

For consistency, maybe this could be also cited in  
draft-ietf-rmcat-rtp-cc-feedback-04, and perhaps some other drafts,

Gorry

---

From: Zaheduzzaman Sarker <[email-masked]>
Date: Thu, 8 Nov 2018 09:48:04 +0000

Hi Gorry,

Thanks for the text suggestion. Please see inline below.

BR
Zahed

On 2018-11-08, 12:31, "rmcat on behalf of G Fairhurst" <[email-masked] on behalf of [email-masked]> wrote:

    
    
    OLD:
    
    NEW:

Upto this, it looks good. 
    
This is really good text, but I am not sure we really need to say this in the eval-test draft as we are saying the intention is to run tests in a controlled environment.

I would like to see this text in the eval-criteria and congestion control algorithm draft.   

    
    Gorry

---

From: G Fairhurst <[email-masked]>
Date: Fri, 09 Nov 2018 08:32:55 +0700

On 08/11/2018, 16:48, Zaheduzzaman Sarker wrote:
> On 2018-11-08, 12:31, "rmcat on behalf of G Fairhurst"<[email-masked] on behalf of [email-masked]>  wrote:
>
>
OK - You will know where best to apply the text.

I wonder if the abstract of draft-ietf-rmcat-eval-test should  also say 
that this was  for a controlled environment? It currently does not.

Gorry

---

From: Zaheduzzaman Sarker <[email-masked]>
Date: Sat, 10 Nov 2018 03:38:14 +0000

On 2018-11-09, 08:33, "G Fairhurst" <[email-masked]> wrote:

May be a good idea. Anybody has any objection to it?

BR

Zahed