Subject: [Teas] Stephen Farrell's No Objection on draft-ietf-teas-interconnected-te-info-exchange-06: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Thu, 19 May 2016 06:46:49 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-teas-interconnected-te-info-exchange-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-teas-interconnected-te-info-exchange/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

- The security considerations says to use IPsec or TCP-AO.  To
what extent do we think that this could help with implementation
and deployment of TCP-AO? If it can, great. If it wouldn't, then I'm
not sure there's much point in mentioning TCP-AO given what I
understand it the current state of play there. 

- IPsec can clearly be used, but I wondered if there's really no
place for using TLS between the domains here? That might need a
bit of work, (e.g. to allocate ports or define a STARTTLS
equivalent), but perhaps there's the opportunity here to get that
kind of thing done? That's maybe less of a question for this 
document, but more for the WG in general. (Though if (D)TLS
made sense as part of this, saying so here would be good
probably.)

- I note that the IPR declaration refers to a "standard." As of
now, this document is aiming for BCP, so I've no idea how to
interpret the text in the declaration unless this reverts to PS.
(That said: I don't care much about what kind of RFC results
here, but I agree with the authors that just picking wihtout
requiring text changes for process reasons is right.)

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 19 May 2016 15:07:35 +0100

Stephen,

Happy to be guided on relative merits of TCP-AO and TLS.

When we pushed RFC 5440 through we were asked to include the following text:

   The TCP Authentication Option [TCP-AUTH] (TCP-AO) specifies new
   security procedures for TCP, but is not yet complete.  Since it is
   believed that [TCP-AUTH] will offer significantly improved security
   for applications using TCP, implementers should expect to update
   their implementation as soon as the TCP Authentication Option is
   published as an RFC.

RFC 6952 says:
   Since TCP-AO [RFC5925] has now been published, new PCEP
   implementations should fully support TCP-AO.

6952 goes on to appear to say that routing protocols carried over TCP should implement TCP-AO.

Appendix A refers to PCEP (RFC 5440) and also BGP hence the mention in Section 12.

Now, it is OK if all this has changed or if the "shouldiness" of the advice really doesn't mean anything. 

Please advise what a post-KARP document that refers to a TCP-base routing protocol should say.

Cheers,
Adrian

> -----Original Message-----
> From: Stephen Farrell [mailto:[email-masked]]
> Sent: 19 May 2016 14:47
> To: The IESG
> Cc: [email-masked]; Lou Berger; teas-
> [email-masked]; [email-masked]; [email-masked]
> Subject: Stephen Farrell's No Objection on draft-ietf-teas-interconnected-te-
> info-exchange-06: (with COMMENT)
>

---

From: "Scharf, Michael (Nokia - DE)" <[email-masked]>
Date: Thu, 19 May 2016 14:30:18 +0000

For what it is worth, I do not understand the sentence below "If it wouldn't, then I'm not sure there's much point in mentioning TCP-AO given what I understand it the current state of play there."

TCP-AO is a proposed standard by TCPM and specifically addresses some of the protocols typically used in such environments.

Michael (TCPM co-chair)

-----Original Message-----
From: Teas [mailto:[email-masked]] On Behalf Of Adrian Farrel
Sent: Thursday, May 19, 2016 4:08 PM
To: 'Stephen Farrell'; 'The IESG'
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Teas] Stephen Farrell's No Objection on draft-ietf-teas-interconnected-te-info-exchange-06: (with COMMENT)

Stephen,

RFC 6952 says:

Cheers,
Adrian

> Cc: [email-masked]; Lou 
> Berger; teas- [email-masked]; [email-masked]; [email-masked]
> email addresses included in the To and CC lines. (Feel free to cut 
> this introductory paragraph, however.)
> 
> 
> Please refer to 
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> https://datatracker.ietf.org/doc/draft-ietf-teas-interconnected-te-inf
> o-
> exchange/
> 
> 
> 
> - The security considerations says to use IPsec or TCP-AO.  To what 
> extent do we think that this could help with implementation and 
> deployment of TCP-AO? If it can, great. If it wouldn't, then I'm not 
> sure there's much point in mentioning TCP-AO given what I understand 
> it the current state of play there.
> 
> - IPsec can clearly be used, but I wondered if there's really no place 
> for using TLS between the domains here? That might need a bit of work, 
> (e.g. to allocate ports or define a STARTTLS equivalent), but perhaps 
> there's the opportunity here to get that kind of thing done? That's 
> maybe less of a question for this document, but more for the WG in 
> general. (Though if (D)TLS made sense as part of this, saying so here 
> would be good
> probably.)
> 
> - I note that the IPR declaration refers to a "standard." As of now, 
> this document is aiming for BCP, so I've no idea how to interpret the 
> text in the declaration unless this reverts to PS.
> (That said: I don't care much about what kind of RFC results here, but 
> I agree with the authors that just picking wihtout requiring text 
> changes for process reasons is right.)

_______________________________________________
Teas mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/teas

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 19 May 2016 15:44:57 +0100

Hiya,

On 19/05/16 15:07, Adrian Farrel wrote:
> RFC 6952 says: Since TCP-AO [RFC5925] has now been published, new
> PCEP implementations should fully support TCP-AO.
> 

I don't believe there's any new document there no, so your text is
ok.

Cheers,
S

> 
> Cheers, Adrian
> 
> 
> 
>> -----Original Message----- From: Stephen Farrell
>> [mailto:[email-masked]] Sent: 19 May 2016 14:47 To: The
>> IESG Cc: [email-masked];
>> Lou Berger; teas- [email-masked]; [email-masked]; [email-masked] 
>> Subject: Stephen Farrell's No Objection on
>> draft-ietf-teas-interconnected-te- info-exchange-06: (with
>> COMMENT)
>> 
>> When responding, please keep the subject line intact and reply to
>> all email addresses included in the To and CC lines. (Feel free to
>> cut this introductory paragraph, however.)
>> 
>> 
>> Please refer to
>> https://www.ietf.org/iesg/statement/discuss-criteria.html for more
>> information about IESG DISCUSS and COMMENT positions.
>> 
>> 
>> https://datatracker.ietf.org/doc/draft-ietf-teas-interconnected-te-info-
>>
>> 
exchange/
>> and deployment of TCP-AO? If it can, great. If it wouldn't, then
>> I'm not sure there's much point in mentioning TCP-AO given what I 
>> place for using TLS between the domains here? That might need a bit
>> of work, (e.g. to allocate ports or define a STARTTLS equivalent),
>> but perhaps there's the opportunity here to get that kind of thing
>> done? That's maybe less of a question for this document, but more
>> for the WG in general. (Though if (D)TLS made sense as part of
>> this, saying so here would be good probably.)
>> 
>> (That said: I don't care much about what kind of RFC results here,
>> but I agree with the authors that just picking wihtout requiring
>> text changes for process reasons is right.)
> 
>

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 19 May 2016 15:55:33 +0100

Hi Michael,

On 19/05/16 15:30, Scharf, Michael (Nokia - DE) wrote:
> For what it is worth, I do not understand the sentence below "If it
> wouldn't, then I'm not sure there's much point in mentioning TCP-AO
> given what I understand it the current state of play there."
> 
> TCP-AO is a proposed standard by TCPM and specifically addresses some
> of the protocols typically used in such environments.

Sure, there's no issue with the RFC. If the RFC were widely
implemented and deployed that'd be great. My understanding
though is that that's not currently the case so I wondered if
teas might be something that'd help that along. If it is not
something that'd help that along, then the text in the draft
right now is a tiny bit misleading as it proposes (as an
option) to depend on something that won't be used which I
don't think is actually a good way to improve security.

I get that we have to start somewhere, and shouldn't give
up easily, but equally, if an RFC isn't being deployed, then
at some point we should also pay attention to that. I'm not
saying we're at that stage with TCP-AO btw, but it has been
6 years so I do wonder about it.

(And to be clear: none of the above is asking for a change
to the current document unless the authors/wg want to make
such a change, which it seems they don't.)

Cheers,
S.

> 
> Michael (TCPM co-chair)
> 
> 
> -----Original Message----- From: Teas [mailto:[email-masked]]
> On Behalf Of Adrian Farrel Sent: Thursday, May 19, 2016 4:08 PM To:
> 'Stephen Farrell'; 'The IESG' Cc:
> [email-masked];
> [email-masked]; [email-masked]; [email-masked] Subject: Re:
> [Teas] Stephen Farrell's No Objection on
> draft-ietf-teas-interconnected-te-info-exchange-06: (with COMMENT)
> 
> Stephen,
> 
o-
>> deployment of TCP-AO? If it can, great. If it wouldn't, then I'm
> _______________________________________________ Teas mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/teas
>

---

From: "Scharf, Michael (Nokia - DE)" <[email-masked]>
Date: Thu, 19 May 2016 15:10:22 +0000

The pre-standard version of TCP-AO seems very widely deployed with 
interoperability among the TCP stacks. But why does this matter for a TEAS 
document? This is TCPM business.

Michael

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]]
Sent: Thursday, May 19, 2016 4:56 PM
To: Scharf, Michael (Nokia - DE); [email-masked]; 'The IESG'
Cc: [email-masked]; 
[email-masked]; [email-masked]; [email-masked]
Subject: Re: [Teas] Stephen Farrell's No Objection on 
draft-ietf-teas-interconnected-te-info-exchange-06: (with COMMENT)

Hi Michael,

Cheers,
S.

o-

---

From: Lou Berger <[email-masked]>
Date: Thu, 19 May 2016 11:15:50 -0400

On 5/19/2016 11:10 AM, Scharf, Michael (Nokia - DE) wrote:
> document? 
This document, from TEAS, refers to BGP and PCEP.  Both of these use
TCP.  Both also have their own WG, so TEAS is just the user here.

Lou

> This is TCPM business.