Subject: Re: [sfc] Fwd: IETF WG state changed for draft-ietf-sfc-nsh-integrity

From: <[email-masked]>
Date: Wed, 3 Feb 2021 10:11:38 +0000

Hi Greg,

Thank you for the comment.

As explained in Section 7.2, if no encryption is used the IV Length field will be followed by the MAC:

   The NSH imposer computes the message integrity for the target NSH
   data (depending on the integrity protection scope discussed in
   Section 5<https://tools.ietf.org/html/draft-ietf-sfc-nsh-integrity-03#section-5>) using MAC_KEY and HMAC algorithm.  It inserts the MAC in
   the "MAC and Encrypted Metadata" Context Header.  The length of the
   MAC is decided by the HMAC algorithm adopted for the particular key
   identifier.

I guess you were confused by figures 6 and 7 where we put “Context Headers to encrypt (opt.)” right after Initialization Vector. Will fix that to avoid confusion.

Cheers,
Med

De : Greg Mirsky [mailto:[email-masked]]
Envoyé : vendredi 29 janvier 2021 19:20
À : Joel M. Halpern <[email-masked]>; [email-masked]
Cc : [email-masked]
Objet : Re: [sfc] Fwd: IETF WG state changed for draft-ietf-sfc-nsh-integrity

Dear Authors,
I appreciate your kind consideration of my comments on the draft. I've reviewed the updates. It all looks good. I might have a small question about the case of IV Length = 0. The updated text suggests:
       If encryption is not used, IV length is set to zero
       (that is, no "Initialization Vector" is included).
As I understand it, that means that the IV Length field is immediately followed by the padding as explained in the last paragraph in Section 5:
   The "MAC and Encrypted Metadata" Context Headers are padded out to a
    multiple of 4 bytes as per Section 2.2 of [RFC8300].
Is that correct?

And yes, I support progressing this document to publication.

Regards,
Greg

Regards,
Greg

On Thu, Jan 28, 2021 at 7:33 AM Joel M. Halpern <[email-masked]<mailto:[email-masked]>> wrote:
As you can see below, the SFC Chairs have started the WG last Call for
the nsh-integrity draft.  Please respond.
Thank you,
Joel

-------- Forwarded Message -------

The IETF WG state of draft-ietf-sfc-nsh-integrity has been changed to "In WG
Last Call" from "WG Document" by Joel Halpern:

https://datatracker.ietf.org/doc/draft-ietf-sfc-nsh-integrity/

Comment:
This starts the SFC Working Group last call for the NSH integrity protection
document.  This will run through the end of the day February 11, 2021.
(Don't worry about time zone.  If it is still Feb 11 2021 somewhere in the
world, you can send in comments.)  Please respond.  Silence is not consent,
and when (if, but we hope when) we send this to the AD, we need to be
able to
describe meaningful WG support for the publication.  And if possible, more
than just +1.

Thank you,
Joel (and Jim)

_______________________________________________
sfc mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sfc

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: <[email-masked]>
Date: Wed, 3 Feb 2021 20:53:21 +0000

Dear all,
I agree that the doc should move forward.
I have sent a list of nits detected and questions for minor clarifications to the authors in parallel.
Thanks for the good work!
 Best Regards
Dirk 

-----Original Message-----
From: sfc <[email-masked]> On Behalf Of Joel M. Halpern
Sent: Donnerstag, 28. Januar 2021 16:33
To: [email-masked]
Subject: [sfc] Fwd: IETF WG state changed for draft-ietf-sfc-nsh-integrity

As you can see below, the SFC Chairs have started the WG last Call for the nsh-integrity draft.  Please respond.
Thank you,
Joel

-------- Forwarded Message -------

Comment:

Thank you,
Joel (and Jim)

[email-masked]

---

From: <[email-masked]>
Date: Thu, 4 Feb 2021 10:17:38 +0800 (CST)

Dear all,

I read through the latest draft, Everything looks good. 

I support progressing this document to publication.

Best Regards,

Yuehua Wei

M: +86 13851460269 E: [email-masked]

原始邮件

发件人：JoelM.Halpern
收件人：[email-masked];
日 期 ：2021年01月28日 23:41
主 题 ：[sfc] Fwd: IETF WG state changed for draft-ietf-sfc-nsh-integrity

-------- Forwarded Message -------

 
Comment:
 
Thank you,
Joel (and Jim)

---

From: <[email-masked]>
Date: Thu, 4 Feb 2021 06:27:05 +0000

Hi Dirk, 

Thank you. 

FWIW, your comments are recorded at https://github.com/boucadair/draft-ietf-sfc-nsh-integrity/issues/4.  

Cheers,
Med

> -----Message d'origine-----
> De : sfc [mailto:[email-masked]] De la part de Dirk.von-
> [email-masked]
> Envoyé : mercredi 3 février 2021 21:53
> À : [email-masked]; [email-masked]
> I have sent a list of nits detected and questions for minor
> clarifications to the authors in parallel.
> As you can see below, the SFC Chairs have started the WG last Call
> for the nsh-integrity draft.  Please respond.
> Thank you,
> Joel
> 
> 
> The IETF WG state of draft-ietf-sfc-nsh-integrity has been changed to
> "In WG Last Call" from "WG Document" by Joel Halpern:
> 
> This starts the SFC Working Group last call for the NSH integrity
> protection document.  This will run through the end of the day
> February 11, 2021.
> (Don't worry about time zone.  If it is still Feb 11 2021 somewhere
> in the world, you can send in comments.)  Please respond.  Silence is
> not consent, and when (if, but we hope when) we send this to the AD,
> we need to be able to describe meaningful WG support for the
> publication.  And if possible, more than just +1.
> 
> Thank you,
> Joel (and Jim)
>

---

From: <[email-masked]>
Date: Thu, 4 Feb 2021 07:18:11 +0000

Hi Greg,

We made some changes to avoid the confusion raised in the message below. The changes can be tracked at:
https://tinyurl.com/nsh-integrity-latest

Hope this is better.

Cheers,
Med

De : [email-masked] [mailto:[email-masked]]
Envoyé : mercredi 3 février 2021 11:12
À : Greg Mirsky <[email-masked]>
Cc : [email-masked]; [email-masked]; Joel M. Halpern <[email-masked]>
Objet : RE: [sfc] Fwd: IETF WG state changed for draft-ietf-sfc-nsh-integrity

Hi Greg,

Cheers,
Med

De : Greg Mirsky [mailto:[email-masked]]
Envoyé : vendredi 29 janvier 2021 19:20
À : Joel M. Halpern <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Cc : [email-masked]<mailto:[email-masked]>
Objet : Re: [sfc] Fwd: IETF WG state changed for draft-ietf-sfc-nsh-integrity

Dear Authors,

Regards,
Greg

Regards,
Greg

-------- Forwarded Message -------

Comment:

Thank you,
Joel (and Jim)

Thank you.

---

From: <[email-masked]>
Date: Thu, 4 Feb 2021 13:19:13 +0000

Dirk, 

A version that integrates almost all your inputs is now available at: https://tinyurl.com/nsh-integrity-latest. Please check.   

For this one: 

==
Base Header: Provides information about the service header/ Base and Service Headers 
> Is it rather Service Path Header(s) what is meant here - or what is difference between Service Header and NSH??
==

we are actually echoing Section 2.1 of 8300. That text is correct as it is basically referring to the role of "MD type" and "next protocol". The service header covers both the "service path header" and context headers.

Cheers,
Med

> De : sfc [mailto:[email-masked]] De la part de
> [email-masked]
> Envoyé : jeudi 4 février 2021 07:27
> À : [email-masked]; [email-masked]; [email-masked]
> FWIW, your comments are recorded at
> https://github.com/boucadair/draft-ietf-sfc-nsh-integrity/issues/4.
> 
> Cheers,
> Med
> 
> > [email-masked] Envoyé : mercredi 3 février 2021 21:53 À :
> > [email-masked]; [email-masked] Objet : Re: [sfc] Fwd: IETF WG
> state
> > changed for draft-ietf-sfc-nsh- integrity
> >
> > Dear all,
> in
> > the world, you can send in comments.)  Please respond.  Silence is
> not
> > consent, and when (if, but we hope when) we send this to the AD, we
> > need to be able to describe meaningful WG support for the
> publication.
> _____________________________________________________________________
> ____________________________________________________
> 
> Ce message et ses pieces jointes peuvent contenir des informations
> confidentielles ou privilegiees et ne doivent donc pas etre diffuses,
> exploites ou copies sans autorisation. Si vous avez recu ce message
> par erreur, veuillez le signaler a l'expediteur et le detruire ainsi
> que les pieces jointes. Les messages electroniques etant susceptibles
> d'alteration, Orange decline toute responsabilite si ce message a ete
> altere, deforme ou falsifie. Merci.
> 
> This message and its attachments may contain confidential or
> privileged information that may be protected by law; they should not
> be distributed, used or copied without authorisation.
> If you have received this email in error, please notify the sender
> and delete this message and its attachments.

---

From: <[email-masked]>
Date: Thu, 4 Feb 2021 13:54:36 +0000

Hi Med,
thanks for quick clarification!
Best Regards
Dirk 

-----Original Message-----
From: [email-masked] <[email-masked]> 
Sent: Donnerstag, 4. Februar 2021 14:19
To: von Hugo, Dirk <[email-masked]>; [email-masked]; [email-masked]
Subject: RE: [sfc] Fwd: IETF WG state changed for draft-ietf-sfc-nsh-integrity

Dirk, 

For this one: 

==
==

Cheers,
Med

> [email-masked] Envoyé : jeudi 4 février 2021 07:27 À : 
> [email-masked]; [email-masked]; [email-masked] Objet : 
> Re: [sfc] Fwd: IETF WG state changed for draft-ietf-sfc-nsh- integrity
> 
> Hi Dirk,
> 
> Thank you.
> 

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Greg Mirsky <[email-masked]>
Date: Thu, 4 Feb 2021 07:11:37 -0800

Hi Med,
thank you for the quick updates. These are very helpful and the text is
perfectly clear.

Regards,
Greg

On Wed, Feb 3, 2021 at 11:18 PM <[email-masked]> wrote:

> *De :* [email-masked] [mailto:[email-masked]]
> *Envoyé :* mercredi 3 février 2021 11:12
> *À :* Greg Mirsky <[email-masked]>
> *Cc :* [email-masked]; [email-masked]; Joel M.
> Halpern <[email-masked]>
> *Objet :* RE: [sfc] Fwd: IETF WG state changed for
> draft-ietf-sfc-nsh-integrity
>
>
>
> Hi Greg,
>
>
>
>    Section 5
> <https://tools.ietf.org/html/draft-ietf-sfc-nsh-integrity-03#section-5>)
> using MAC_KEY and HMAC algorithm.  It inserts the MAC in
>
> *De :* Greg Mirsky [mailto:[email-masked] <[email-masked]>]
> *Envoyé :* vendredi 29 janvier 2021 19:20
> *À :* Joel M. Halpern <[email-masked]>;
> [email-masked]
> *Cc :* [email-masked]
> *Objet :* Re: [sfc] Fwd: IETF WG state changed for
> draft-ietf-sfc-nsh-integrity
>
>
>
> Dear Authors,
>
> I appreciate your kind consideration of my comments on the draft. I've
> reviewed the updates. It all looks good. I might have a small question
> about the case of IV Length = 0. The updated text suggests:
>
> As I understand it, that means that the IV Length field is immediately
> followed by the padding as explained in the last paragraph in Section 5:
>
> On Thu, Jan 28, 2021 at 7:33 AM Joel M. Halpern <[email-masked]>
> wrote:
>
> protection

---

From: Dhruv Dhody <[email-masked]>
Date: Tue, 9 Feb 2021 15:19:37 +0530

Hi Joel,

I have read the I-D and I feel that the document is ready for
publication. Authors have done a good job in clearly describing the
need and mechanism for integrity protection in NSH.

I see some control plane aspects scattered across the I-D (while
mostly out of scope), wondering if it is a good idea to consolidate
them in a section.

Thanks!
Dhruv

---

From: <[email-masked]>
Date: Tue, 9 Feb 2021 12:46:32 +0000

Hi Dhruv, all, 

Thank you for the feedback. 

We added a note to remind that NSH-aware control plane solution is out of the scope. 

As some may be confused that the control plane is out of the scope but it is still mentioned in the text, we went with an update that "softens" (rather than groups) the use of "control plane".

The edits can be seen at: https://tinyurl.com/nsh-integrity-latest. 

Hope this is better. 

Cheers,
Med

> De : sfc [mailto:[email-masked]] De la part de Dhruv Dhody
> Envoyé : mardi 9 février 2021 10:50
> À : Joel M. Halpern <[email-masked]>
> Cc : [email-masked]