Subject: Re: [Dots] WGLC on draft-ietf-dots-architecture-08

From: <[email-masked]>
Date: Mon, 3 Dec 2018 06:47:09 +0000

Hi Tiru, 

I updated the file to take into account your feedback:

Xml: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-ietf-dots-architecture-09.xml   
Diff: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/wdiff%20draft-ietf-dots-architecture-09.txt%20draft-ietf-dots-architecture-09.pdf 

Cheers,
Med

> -----Message d'origine-----
> De : Dots [mailto:[email-masked]] De la part de Konda, Tirumaleswar
> Reddy
> Envoyé : vendredi 30 novembre 2018 17:14
> À : BOUCADAIR Mohamed TGI/OLN; Roman Danyliw; [email-masked]
> Objet : Re: [Dots] WGLC on draft-ietf-dots-architecture-08
> 
> Hi Med,
> 
> I don't fully agree with some of the updates.  I propose the following
> changes:
> 
> [1] Replace " A DOTS session can be a DOTS data channel session or a DOTS
> signal channel session" with "A DOTS session can be a DOTS data channel
> session or a DOTS signal channel session or both."
> [2] I thought we agreed to say the following:
> A DOTS signal channel session is associated with a single transport
> connection (TCP or UDP session) and an ephemeral security association (e.g. a
> TLS or DTLS session). Similarly,  a DOTS data channel session is associated
> with a single TCP connection and an ephemeral TLS security association.
> [3] Direct and recursive signaling is applicable to both DOTS signal and data
> channel sessions, replace "DOTS signal channel session" with "DOTS session".
> [4] In Section 3.1.2, replace "session" with "DOTS session"
> [5] Remove the following line:
> "These sessions may belong to the same or distinct DOTS channels (signal or
> data).
> 
> Cheers,
> -Tiru
> 
> > -----Original Message-----
> > From: [email-masked] <[email-masked]>
> > Sent: Friday, November 30, 2018 5:40 PM
> > To: Konda, Tirumaleswar Reddy <[email-masked]>;
> > Roman Danyliw <[email-masked]>; [email-masked]
> > Subject: RE: WGLC on draft-ietf-dots-architecture-08
> >
> > This email originated from outside of the organization. Do not click links
> or
> > open attachments unless you recognize the sender and know the content is
> safe.
> >
> > Re-,
> >
> > OK. Thanks.
> >
> > FWIW, I also made on my side some changes that I'd like to see made to fix
> the
> > issues we discussed so far:
> >
> > Xml: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-
> ietf-
> > dots-architecture-09.xml
> > Diff: https://github.com/boucadair/IETF-Drafts-
> > Reviews/blob/master/wdiff%20draft-ietf-dots-architecture-09.txt%20draft-
> ietf-
> > dots-architecture-09.pdf
> >
> > Feel free to reuse the modified version.
> >
> > (Removing parts that were agreed and focusing on the last pending one)
> >
> > > > > >
> > > > > > > DOTS data channel draft is not using the term "DOTS data
> > > > > > > channel session", we can fix the signal channel draft to use
> > > > > > > "DOTS data channel" instead of "DOTS data channel session".
> > > > > > >
> > > > > >
> > > > > > [Med] May be. BTW, this part of the text:
> > > > > >
> > > > > > " Conversely, a
> > > > > >    DOTS session cannot exist without an established signal channel
> "
> > > > > >
> > > > > > is conflicting with this one:
> > > > > >
> > > > > > "
> > > > > > To allow for DOTS
> > > > > >    service flexibility, neither the order of contact nor the time
> > > > > >    interval between channel creations is specified.  A DOTS client
> MAY
> > > > > >    establish signal channel first, and then data channel, or
> > > > > > vice
> > > versa."
> > > >
> > > > [Med] This one is still pending.
> > >
> > > The above line looks clear to me, what is the confusion ?
> > >
> >
> > [Med] The problem is not with the last line with this one:
> >
> > "DOTS session cannot exist without an established signal channel"
> >
> > Which means that dots signal channel session is a pre-requisite for DOTS
> data
> > channel. This is conflict with the other excerpt I cited.
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Mon, 3 Dec 2018 11:17:50 +0000

Thanks Med, update looks good; just one Nit
Redirected signaling is also applicable to DOTS data channel (replace "DOTS signal channel session" with "DOTS session").

-Tiru

> Sent: Monday, December 3, 2018 12:17 PM
> Reviews/blob/master/wdiff%20draft-ietf-dots-architecture-09.txt%20draft-ietf-
> dots-architecture-09.pdf
> 
> Cheers,
> Med
> 
> > De : Dots [mailto:[email-masked]] De la part de Konda,
> > Tirumaleswar Reddy Envoyé : vendredi 30 novembre 2018 17:14 À :
> > BOUCADAIR Mohamed TGI/OLN; Roman Danyliw; [email-masked] Objet : Re:
> > [Dots] WGLC on draft-ietf-dots-architecture-08
> >
> > Hi Med,
> >
> > [1] Replace " A DOTS session can be a DOTS data channel session or a
> > DOTS signal channel session" with "A DOTS session can be a DOTS data
> > channel session or a DOTS signal channel session or both."
> > connection (TCP or UDP session) and an ephemeral security association
> > (e.g. a TLS or DTLS session). Similarly,  a DOTS data channel session
> > is associated with a single TCP connection and an ephemeral TLS security
> association.
> > [3] Direct and recursive signaling is applicable to both DOTS signal
> > and data channel sessions, replace "DOTS signal channel session" with "DOTS
> session".
> > "These sessions may belong to the same or distinct DOTS channels
> > (signal or data).
> >
> > Cheers,
> > -Tiru
> >
> > > Xml:
> > > https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-
> > ietf-
> > > dots-architecture-09.xml
> > > > > > > > channel session", we can fix the signal channel draft to
> > > > > > > > use "DOTS data channel" instead of "DOTS data channel session".
> > > > > > > >
> > > > > > >

---

From: <[email-masked]>
Date: Mon, 3 Dec 2018 12:19:52 +0000

Re-,

OK. 

As per redirected signaling, the WG has only this requirement for the signal channel (SIG-005).

Cheers,
Med

> Envoyé : lundi 3 décembre 2018 12:18
> Redirected signaling is also applicable to DOTS data channel (replace "DOTS
> signal channel session" with "DOTS session").
> 
> -Tiru
>

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Mon, 3 Dec 2018 14:39:29 +0000

> Sent: Monday, December 3, 2018 5:50 PM
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> Re-,
> 
> OK.
> 

SIG-005 is explicitly discussing redirected signaling because of the attack condition.
I don't see a reason why redirect signaling is not applicable to DOTS data channel to increase the DOTS server
operational flexibility and scalability.

-Tiru

> > Tirumaleswar Reddy Envoyé : lundi 3 décembre 2018 12:18 À : BOUCADAIR
> > Mohamed TGI/OLN; Roman Danyliw; [email-masked] Objet : Re: [Dots] WGLC
> > on draft-ietf-dots-architecture-08
> >
> > Thanks Med, update looks good; just one Nit Redirected signaling is
> > also applicable to DOTS data channel (replace "DOTS signal channel
> > session" with "DOTS session").
> >
> > -Tiru
> >
> > > > [1] Replace " A DOTS session can be a DOTS data channel session or
> > > > a DOTS signal channel session" with "A DOTS session can be a DOTS
> > > > data channel session or a DOTS signal channel session or both."
> > > > A DOTS signal channel session is associated with a single
> > > > transport connection (TCP or UDP session) and an ephemeral
> > > > security association (e.g. a TLS or DTLS session). Similarly,  a
> > > > DOTS data channel session is associated with a single TCP
> > > > connection and an ephemeral TLS security
> > > association.
> > > > [3] Direct and recursive signaling is applicable to both DOTS
> > > > signal and data channel sessions, replace "DOTS signal channel
> > > > session" with
> > "DOTS
> > > session".
> > > > > Reviews/blob/master/wdiff%20draft-ietf-dots-architecture-09.txt%
> > > > > 20dr
> > > > > aft-
> > > > ietf-
> > > > > dots-architecture-09.pdf
> > > > >
> > > > > (Removing parts that were agreed and focusing on the last
> > > > > pending
> > > > > one)
> > > > >
> > > > > > > > >
> > > > > > > > > > DOTS data channel draft is not using the term "DOTS
> > > > > > > > > > data channel session", we can fix the signal channel
> > > > > > > > > > draft to use "DOTS data channel" instead of "DOTS data
> > > > > > > > > > channel
> > session".
> > > > > > > > > >
> > > > > > > > >
> > > > > > > > >    service flexibility, neither the order of contact nor
> > > > > > > > > the
> > time
> > > > > > > > >    establish signal channel first, and then data
> > > > > > > > > channel, or vice
> > > > > > versa."
> > > > > > >

---

From: <[email-masked]>
Date: Tue, 4 Dec 2018 12:15:56 +0000

Tiru, 

We don't have the same constraints for the data channel compared to those of the signal channel. As such, when a problem is encountered to contact a DOTS server, another server may be used following some local logic (e.g., sequential through a list). 

I suggest we keep the architecture aligned with the requirements agreed so far by the WG: that is, redirect signaling is only a requirements for the signal channel.

Thank you. 

Cheers,
Med

> Envoyé : lundi 3 décembre 2018 15:39
> > As per redirected signaling, the WG has only this requirement for the
> signal
> > channel (SIG-005).
>

---

From: <[email-masked]>
Date: Tue, 4 Dec 2018 12:21:52 +0000

Re-,

FWIW, a version which integrates my initial comments including the conclusion of the discussion in this thread is available at: 

This version fixes also some "stale" text such as references to "Operational Requirements" that are not anymore listed as such in draft-ietf-dots-requirements. 

Cheers,
Med

> De : Dots [mailto:[email-masked]] De la part de
> [email-masked]
> Envoyé : jeudi 29 novembre 2018 09:31
> À : Roman Danyliw; [email-masked]
> Hi Roman, all,
> I support this draft to be sent to the IESG for publication.
> 
> Some easy-to-fix comment, though:
> 
> (1) The document cites [I-D.ietf-dots-requirements] in may occurrences. I
> suggest these citations to be more specific, that is to point the specific
> REQ# or the section. Doing so would help readers not familiar with DOTS
> documents to easily link the various pieces.
> 
> (2) I used to point people to the DOTS architecture I-D when I receive
> comments/questions about the notion of "DOTS session" and to the Requirements
> I-D for clarification about DOTS channels. It seems that some clarifications
> are needed in the architecture I-D to explain for readers not familiar with
> all DOTS documents, for example:
> - the link with the underlying transport sessions/connections and security
> associations.
> - mitigations are not bound to a DOTS session but to a DOTS client/domain.
> 
> (3) The signal channel I-D uses "DOTS signal channel session", "DOTS signal
> channel sessions" and "DOTS data channel session" to refer to specific DOTS
> sessions. I'd like to have these terms introduced also in the arch I-D.
> 
> BTW, the signal channel uses in few occurrences "DOTS session"; those can be
> changed to "DOTS signal channel session". There is no occurrence of "DOTS
> session" in the data channel I-D.
> 
> Thank you.
> 
> Cheers,
> Med
> 
> > De : Dots [mailto:[email-masked]] De la part de Roman Danyliw
> > Envoyé : mardi 27 novembre 2018 23:15
> > À : [email-masked]
> > Objet : [Dots] WGLC on draft-ietf-dots-architecture-08
> >
> > Hello!
> >
> > Consistent with our discussion at the Bangkok meeting, we are starting a
> > working group last call (WGLC) for the DOTS architecture draft:
> >
> > DOTS Architecture
> > draft-ietf-dots-architecture-08
> > https://tools.ietf.org/html/draft-ietf-dots-architecture-08
> >
> > Please send comments to the DOTS mailing list -- feedback on remaining
> issues
> > or needed changes; as well as endorsements that this draft is ready.
> >
> > This WGLC will end on December 12, 2018.
> >
> > Thanks,
> > Roman and Frank
> >

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 4 Dec 2018 13:46:03 +0000

Thanks Med, Update looks good. Nit: Figure 12 needs to use DOTS signal channel session instead of DOTS session.

-Tiru

> From: Dots <[email-masked]> On Behalf Of
> Sent: Tuesday, December 4, 2018 5:52 PM
> To: [email-masked]
> Subject: Re: [Dots] WGLC on draft-ietf-dots-architecture-08
> 
> FWIW, a version which integrates my initial comments including the conclusion
> of the discussion in this thread is available at:
> 
> This version fixes also some "stale" text such as references to "Operational
> Requirements" that are not anymore listed as such in draft-ietf-dots-
> requirements.
> 
> Cheers,
> Med
> 
> > [email-masked] Envoyé : jeudi 29 novembre 2018 09:31 À :
> > Roman Danyliw; [email-masked] Objet : Re: [Dots] WGLC on
> > (1) The document cites [I-D.ietf-dots-requirements] in may
> > occurrences. I suggest these citations to be more specific, that is to
> > point the specific REQ# or the section. Doing so would help readers
> > not familiar with DOTS documents to easily link the various pieces.
> >
> > comments/questions about the notion of "DOTS session" and to the
> > Requirements I-D for clarification about DOTS channels. It seems that
> > some clarifications are needed in the architecture I-D to explain for
> > readers not familiar with all DOTS documents, for example:
> > - the link with the underlying transport sessions/connections and
> > security associations.
> > (3) The signal channel I-D uses "DOTS signal channel session", "DOTS
> > signal channel sessions" and "DOTS data channel session" to refer to
> > specific DOTS sessions. I'd like to have these terms introduced also in the arch
> I-D.
> >
> > BTW, the signal channel uses in few occurrences "DOTS session"; those
> > can be changed to "DOTS signal channel session". There is no
> > occurrence of "DOTS session" in the data channel I-D.
> >
> > Thank you.
> >
> > Cheers,
> > Med
> >
> > > Envoyé : mardi 27 novembre 2018 23:15 À : [email-masked] Objet :
> > > Consistent with our discussion at the Bangkok meeting, we are
> > > starting a working group last call (WGLC) for the DOTS architecture draft:
> > >
> > > DOTS Architecture

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 4 Dec 2018 13:46:59 +0000

> Sent: Tuesday, December 4, 2018 5:46 PM
> We don't have the same constraints for the data channel compared to those of
> the signal channel. As such, when a problem is encountered to contact a DOTS
> server, another server may be used following some local logic (e.g., sequential
> through a list).
> 
> I suggest we keep the architecture aligned with the requirements agreed so far
> by the WG: that is, redirect signaling is only a requirements for the signal
> channel.

I don't see a strong reason to disagree.

-Tiru

> > Tirumaleswar Reddy Envoyé : lundi 3 décembre 2018 15:39 À : BOUCADAIR
> > I don't see a reason why redirect signaling is not applicable to DOTS
> > data channel to increase the DOTS server operational flexibility and
> > scalability.
> >
> > -Tiru
> >
> > >
> > > Cheers,
> > > Med
> > >
> > > > Tirumaleswar Reddy Envoyé : lundi 3 décembre 2018 12:18 À :
> > > > BOUCADAIR Mohamed TGI/OLN; Roman Danyliw; [email-masked] Objet :
> > > > Re: [Dots] WGLC on draft-ietf-dots-architecture-08
> > > >
> > > > Thanks Med, update looks good; just one Nit Redirected signaling
> > > > is also applicable to DOTS data channel (replace "DOTS signal
> > > > channel session" with "DOTS session").
> > > >
> > > > -Tiru
> > > >
> > > > > > BOUCADAIR Mohamed TGI/OLN; Roman Danyliw; [email-masked]
> Objet :
> > > Re:
> > > > > > [1] Replace " A DOTS session can be a DOTS data channel
> > > > > > session or a DOTS signal channel session" with "A DOTS session
> > > > > > can be a DOTS data channel session or a DOTS signal channel session
> or both."
> > > > > > security association (e.g. a TLS or DTLS session). Similarly,
> > > > > > a DOTS data channel session is associated with a single TCP
> > > > > > "These sessions may belong to the same or distinct DOTS
> > > > > > channels (signal or data).
> > > > > >
> > > > > > Cheers,
> > > > > > -Tiru
> > > > > >
> > > > > > > https://github.com/boucadair/IETF-Drafts-Reviews/blob/master
> > > > > > > /dra
> > > > > > > ft-
> > > > > > ietf-
> > > > > > > dots-architecture-09.xml
> > > > > > > > > > > > DOTS data channel draft is not using the term
> > > > > > > > > > > > "DOTS data channel session", we can fix the signal
> > > > > > > > > > > > channel draft to use "DOTS data channel" instead
> > > > > > > > > > > > of "DOTS data channel
> > > > session".
> > > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >    service flexibility, neither the order of contact
> > > > > > > > > > > nor the
> > > > time