Subject: [Taps] Éric Vyncke's Discuss on draft-ietf-taps-transport-security-11: (with DISCUSS and COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Thu, 09 Apr 2020 03:01:44 -0700

Éric Vyncke has entered the following ballot position for
draft-ietf-taps-transport-security-11: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-taps-transport-security/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you for the work put into this document. It is really easy to read.

Nevertheless, I am balloting a DISCUSS (see below), I sincerely hope that I am
wrongly asserting the lack of IPv6 support for CurveCP else the easy way to
clear my DISCUSS would be to mention this limitation in section 3 even if the
focus of this I-D is on the API.

Please find below some non-blocking COMMENTs. An answer will be appreciated.

I hope that this helps to improve the document,

Regards,

-éric

== DISCUSS ==

I question the inclusion of CurveCP in the mix as per
https://curvecp.org/addressing.html it does not seem to support IPv6. At the
bare minimum, the I-D should mention this restriction in section 3. (and I hope
to be corrected about CurveCP IPv6 support).

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Please respond to the IoT-directorate review by Mohit:
https://mailarchive.ietf.org/arch/msg/iot-directorate/xTVOvQ7kI78sDPZQuVsTvGB2x0s
Please respond to the INT-DIR review by Brian:
https://mailarchive.ietf.org/arch/msg/int-dir/2IHPgukaAAMvMjO7TXvo_ujcI_I +
Gorry Fairhurst's about GRE

Generic comment about the intended transport: all protocols analyzed in this
document are point to point (no multicast), this should probably be mentioned
in the introduction.

-- Section 1 --
Is there any reason why the integrity property of IPsec AH is not mentioned ?
Same also applies in section 2 when "security protocol" is defined.

-- Section 3 --
Use the wording of "record protocol" generically while the term "record
protocol" is defined in section 2 as a blocked data transport (like in TLS).
Suggest the use of "data transfer protocol" ?

An important property of such protocols is to be able to traverse a NAPT box
(that I hate)... I suggest to mention whether the analyzed protocols support
NAT-traversal in this description section or even in the analysis parts as
having a different view (application and network layers seeing possibly
different IP addresses so a potential impact on the API).

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 9 Apr 2020 12:15:47 +0000

Hi Eric,

Aren't you going a bit to far now with this discuss? Yes, IETF stream
procotocols are expected to support IPv6. This is a non-IETF devleoped security
protocol which is investigated from the perspective of its features to influence
considerations of required API surface for security features. All discussed in
relation to a set of aspects where the only one having to do with addressing is
source-address valdiation and which CurveCP do not support as particular
relevant. 

I don't see how it is going to affect or impact that future work in TAPS WG.

Why do you think an aspect of a protocol that isn't discussed being relevant to
mention? 

If you have a good reason fine then a disclaimer could be added. But I don't see
how it would not result in a unconnected comment on a specific protocol which
has no connection to the purpose of the document.

Cheers

Magnus

> https://datatracker.ietf.org/doc/draft-ietf-taps-transport-security/
https://protect2.fireeye.com/v1/url?k=c6d9b121-9a0dbd7f-c6d9f1ba-8691959ed9b7-6efcfea6e017deb9&q=1&e=d62bfe3e-4eac-4ef1-877e-ac1f40b4418d&u=https%3A%2F%2Fcurvecp.org%2Faddressing.html
>  it does not seem to support IPv6. At the
-- 
Cheers

Magnus Westerlund 

----------------------------------------------------------------------
Networks, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  +46 10 7148287
Torshamnsgatan 23           | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Thu, 9 Apr 2020 12:32:30 +0000

Magnus

A simple mention of the lack of IPv6 in section 3 of the description would be more than enough for me.

-éric

-----Original Message-----
From: iesg <[email-masked]> on behalf of Magnus Westerlund <magnus.westerlund=[email-masked]>
Date: Thursday, 9 April 2020 at 14:16
To: "[email-masked]" <[email-masked]>, Eric Vyncke <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, Mohit Sethi M <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: Éric Vyncke's Discuss on draft-ietf-taps-transport-security-11: (with DISCUSS and COMMENT)

    Hi Eric,

    I don't see how it is going to affect or impact that future work in TAPS WG..

    
    Cheers
    
    Magnus

    -- 
    Cheers
    
    Magnus Westerlund

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 9 Apr 2020 12:41:22 +0000

>
> A simple mention of the lack of IPv6 in section 3 of the description would 
> be
> more than enough for me.

Yes, but why do you consider that relevant for this document?

Cheers

Magnus

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Thu, 9 Apr 2020 13:40:14 +0000

Magnus,

While my comment is not directed to the core of the document, I believe that when one IETF document refers in the section 3, ' Transport Security Protocol Descriptions', to non-IETF protocols, then in order to avoid any 'IETF blessing' of this protocol, it should clearly state the important protocol limitations when describing this protocol.

Regards

-éric

-----Original Message-----
From: iesg <[email-masked]> on behalf of Magnus Westerlund <magnus.westerlund=[email-masked]>
Date: Thursday, 9 April 2020 at 14:41
To: "evyncke=[email-masked]" <evyncke=[email-masked]>, "[email-masked]" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, Mohit Sethi M <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: Éric Vyncke's Discuss on draft-ietf-taps-transport-security-11: (with DISCUSS and COMMENT)

    
    Cheers
    
    Magnus

---

From: Barry Leiba <[email-masked]>
Date: Thu, 9 Apr 2020 09:46:37 -0400

I have to agree with Magnus here: I think this is really a stretch.

Barry

---

From: Kyle Rose <[email-masked]>
Date: Thu, 9 Apr 2020 10:00:52 -0400

Agreed. This document is not an endorsement of any of the protocols
mentioned, merely an analysis from a security perspective. Mentioning IPv6
here would be a non-sequitur.

On Thu, Apr 9, 2020 at 9:46 AM Barry Leiba <[email-masked]> wrote:

> > While my comment is not directed to the core of the document, I believe
> that when one IETF document refers in the section 3, ' Transport Security
> Protocol Descriptions', to non-IETF protocols, then in order to avoid any
> 'IETF blessing' of this protocol, it should clearly state the important
> protocol limitations when describing this protocol.
> >
> > Regards
> >
> > -éric
> >
> > From: iesg <[email-masked]> on behalf of Magnus Westerlund
> <magnus.westerlund=[email-masked]>
> > To: "evyncke=[email-masked]" <evyncke=
> [email-masked]>, "[email-masked]" <[email-masked]>
> > Cc: "[email-masked]" <[email-masked]>, "
> [email-masked]" <[email-masked]>, Mohit Sethi M <
> [email-masked]>, "[email-masked]" <[email-masked]>,
> "[email-masked]" <
> [email-masked]>, "[email-masked]" <
> [email-masked]>, "[email-masked]" <[email-masked]>, "
> [email-masked]" <[email-masked]>
> > Subject: RE: Éric Vyncke's Discuss on
> draft-ietf-taps-transport-security-11: (with DISCUSS and COMMENT)
> >
> >     >

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 9 Apr 2020 14:58:32 +0000

Hi,

Eric and I have discussed this and the proposal is a clarifying change to the initial statement in Section 3:

OLD:

   This section contains brief descriptions of the various security

   protocols currently used to protect data being sent over a network.

NEW: 

   This section contains brief transport and security descriptions of the various security
   protocols currently used to protect data being sent over a network.

The purpose of this change to clarify that these descriptions are only concerning relevant aspects of transport and security. 

Are the WG and authors ok with the above change? 

Cheers

Magnus

From: iesg <[email-masked]> On Behalf Of Kyle Rose
Sent: den 9 april 2020 16:01
To: Barry Leiba <[email-masked]>
Cc: Eric Vyncke (evyncke) <evyncke=[email-masked]>; [email-masked]; [email-masked]; Mohit Sethi M <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; Magnus Westerlund <magnus.westerlund=[email-masked]>; [email-masked]
Subject: Re: Éric Vyncke's Discuss on draft-ietf-taps-transport-security-11: (with DISCUSS and COMMENT)

Agreed. This document is not an endorsement of any of the protocols mentioned, merely an analysis from a security perspective. Mentioning IPv6 here would be a non-sequitur.

On Thu, Apr 9, 2020 at 9:46 AM Barry Leiba <[email-masked] <mailto:[email-masked]> > wrote:

Barry

On Thu, Apr 9, 2020 at 9:40 AM Eric Vyncke (evyncke)
<evyncke=[email-masked] <mailto:[email-masked]> > wrote:
> From: iesg <[email-masked] <mailto:[email-masked]> > on behalf of Magnus Westerlund <magnus..westerlund=[email-masked] <mailto:[email-masked]> >
> To: "evyncke=[email-masked] <mailto:[email-masked]> " <evyncke=[email-masked] <mailto:[email-masked]> >, "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >
> Cc: "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >, "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >, Mohit Sethi M <[email-masked] <mailto:[email-masked]> >, "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >, "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >, "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >, "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >, "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >

---

From: Tommy Pauly <[email-masked]>
Date: Mon, 13 Apr 2020 10:29:44 -0700

> On Apr 9, 2020, at 7:58 AM, Magnus Westerlund <magnus.westerlund=[email-masked]> wrote:
> 
> Hi,
>  

That change sounds fine to me, as an author. We’ll incorporate that in our update.

Best,
Tommy
> On Thu, Apr 9, 2020 at 9:46 AM Barry Leiba <[email-masked] <mailto:[email-masked]>> wrote:
> <evyncke=[email-masked] <mailto:[email-masked]>> wrote:
> >
> > Magnus,
> >
> > From: iesg <[email-masked] <mailto:[email-masked]>> on behalf of Magnus Westerlund <magnus..westerlund=[email-masked] <mailto:[email-masked]>>
> > To: "evyncke=[email-masked] <mailto:[email-masked]>" <evyncke=[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> > Cc: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, Mohit Sethi M <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> _______________________________________________
> Taps mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/taps <https://www.ietf.org/mailman/listinfo/taps>