Subject: [tcpinc] Kathleen Moriarty's Yes on draft-ietf-tcpinc-tcpeno-13: (with COMMENT)

From: Kathleen Moriarty <[email-masked]>
Date: Sat, 11 Nov 2017 05:11:15 -0800

Kathleen Moriarty has entered the following ballot position for
draft-ietf-tcpinc-tcpeno-13: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tcpinc-tcpeno/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for your work on this draft and experiment.  I just have one comment
that I don't think has been mentioned already. In section 4, could you include
reference to Opportunistic security, RFC7435.  The definition has changed
slightly over time and it would be good to link this to the current definition
that is intended.  The work on 7435 was painstaking and the definition varies a
bit in older specs.  I do realize you describe this more in the security
considerations section, but it is much later in the document, so this seemed
like an easy fix.

---

From: David Mazieres <[email-masked]>
Date: Sun, 12 Nov 2017 16:17:40 -0800

Kathleen Moriarty <[email-masked]> writes:

> Thanks for your work on this draft and experiment.  I just have one
> comment that I don't think has been mentioned already. In section 4,
> could you include reference to Opportunistic security, RFC7435.  The
> definition has changed slightly over time and it would be good to link
> this to the current definition that is intended.  The work on 7435 was
> painstaking and the definition varies a bit in older specs.  I do
> realize you describe this more in the security considerations section,
> but it is much later in the document, so this seemed like an easy fix.

Would you be okay if we cited RFC7435 in the security considerations
section (10), rather than section 4?

My issue is that the term "opportunistic security" entails some
subjective judgment (like the fact that it is a form of security) that
requires some context I don't really want to get into at the beginning
of Section 4.  Section 4 is trying to be an objective specification of
what the protocol does with just the minimal rationale necessary for it
to make sense.  The security considerations section already gets into
detail about security, which is why RFC7435 would seem to fit well
there.

Thanks,
David

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 12 Nov 2017 19:43:06 -0500

Hi David,

> detail about security, which is why RFC7435 would seem to fit well

I only suggested section 4 as that's where you first mention OS.  I
think it's important as one reads the draft to understand how you want
that read on first introduction.  The Security Considerations section
is really far down in the draft.  Do you want to add a pointer to the
security considerations from section 4 and in the security
considerations also point to RFC7435?

That would also work for me if the pointer to RFC7435 isn't in section 4.

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 12 Nov 2017 20:27:14 -0500

On Sun, Nov 12, 2017 at 8:25 PM, David Mazieres expires 2018-02-10 PST
<[email-masked]>
wrote:
> Kathleen Moriarty <[email-masked]> writes:
>
> If you want RFC7435 cited upfront, what about doing so in the design
> goals section (1.1)?  The first design goal could be extended to
> something like:
>
> 1. Enable endpoints to negotiate the use of a separately specified TCP
>    encryption protocol (_TEP_) suitable for either opportunistic
>    security [RFC7435] of arbitrary TCP communications or stronger
>    security of applications willing to perform endpoint authentication.

Perfect, thanks!  I think this will help the reader and I appreciate
you addressing the comment.

-- 

Best regards,
Kathleen