Subject: [Taps] Intdir telechat review of draft-ietf-taps-transport-security-11

From: Brian Haberman via Datatracker <[email-masked]>
Date: Fri, 03 Apr 2020 05:10:00 -0700

Reviewer: Brian Haberman
Review result: Ready with Issues

This document is a survey of network security protocols and their interaction
with transport and application protocols. It is clearly written and easy to
read. I have a minor comment on the contents of this draft.

It is not abundantly clear what the criteria was for selecting the subset of
security protocols included in this draft. Some notable omissions include SSH,
L2TP, and GRE. These seem like interesting omissions given their popularity in
a number of deployment scenarios. Not a showstopper in my opinion, but
interesting to note.

---

From: Gorry Fairhurst <[email-masked]>
Date: Fri, 3 Apr 2020 13:50:55 +0100

I think GRE (the one I know more) should be mentioned as existing somehow.

... even if the WG doesn't want to add an analysis of GRE!

A suggested starting text blob proposal for GRE could be:

Generic Routing Encapsulation [RFC2784] specifies a protocol for encapsulation of an arbitrary protocol over another arbitrary network layer protocol.  GRE tunnels do not by default provide security features. [RFC2890] describes enhancements by which two fields, Key and Sequence Number, can be optionally carried in the GRE Header to implement security functions. [RFC8086] specifies a method of encapsulating network protocol
packets using GRE in UDP. GRE can be used in combination with IPsec (see RFC2890).

Gorry

On 03/04/2020 13:10, Brian Haberman via Datatracker wrote:
> _______________________________________________
> Taps mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/taps

---

From: Tommy Pauly <[email-masked]>
Date: Wed, 22 Apr 2020 10:06:52 -0700

Hi Brian,

Thanks for the review! You can find an updated version of the document here:

https://ietf-tapswg.github.io/draft-ietf-taps-transport-security/draft-ietf-taps-transport-security.html <https://ietf-tapswg.github.io/draft-ietf-taps-transport-security/draft-ietf-taps-transport-security.html>

The authors discussed, and believe that SSH, L2TP, and GRE do not expose significant new surfaces for transports and applications compared to the existing protocols surveyed. We did, however, add specific text and references to those protocols in the introduction as explanation.

Thanks,
Tommy

> On Apr 3, 2020, at 5:10 AM, Brian Haberman via Datatracker <[email-masked]> wrote:
> 
> Reviewer: Brian Haberman