IETF Logo Mail Archive

Re: [alto] Roman Danyliw's No Objection on draft-ietf-alto-new-transport-21: (with COMMENT)

kaigao@scu.edu.cn Wed, 03 January 2024 12:07 UTC

Return-Path: <kaigao@scu.edu.cn>
X-Original-To: alto@ietfa.amsl.com
Delivered-To: alto@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0713C31A608; Wed, 3 Jan 2024 04:07:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.904
X-Spam-Level:
X-Spam-Status: No, score=-6.904 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9xTAl3zAIRGJ; Wed, 3 Jan 2024 04:06:57 -0800 (PST)
Received: from zg8tmtyylji0my4xnjqumte4.icoremail.net (zg8tmtyylji0my4xnjqumte4.icoremail.net [162.243.164.118]) by ietfa.amsl.com (Postfix) with ESMTP id B1250C31A606; Wed, 3 Jan 2024 04:06:54 -0800 (PST)
Received: from kaigao$scu.edu.cn ( [221.221.167.164] ) by ajax-webmail-app1 (Coremail) ; Wed, 3 Jan 2024 20:06:51 +0800 (GMT+08:00)
X-Originating-IP: [221.221.167.164]
Date: Wed, 03 Jan 2024 20:06:51 +0800
X-CM-HeaderCharset: UTF-8
From: kaigao@scu.edu.cn
To: Roman Danyliw <rdd@cert.org>
Cc: The IESG <iesg@ietf.org>, draft-ietf-alto-new-transport@ietf.org, alto-chairs@ietf.org, alto@ietf.org, mohamed.boucadair@orange.com
X-Priority: 3
X-Mailer: Coremail Webmail Server Version 2023.2-cmXT5 build 20230915(bf90896b) Copyright (c) 2002-2024 www.mailtech.cn scu
In-Reply-To: <170422856609.1398.8988980260013713796@ietfa.amsl.com>
References: <170422856609.1398.8988980260013713796@ietfa.amsl.com>
Content-Transfer-Encoding: base64
Content-Type: text/plain; charset="UTF-8"
MIME-Version: 1.0
Message-ID: <788b30eb.c839.18ccf382082.Coremail.kaigao@scu.edu.cn>
X-Coremail-Locale: en_US
X-CM-TRANSID: Mf0DCgB3h3bbTZVlJFtRAQ--.11822W
X-CM-SenderInfo: 5ndlwt3r6vu3oohg3hdfq/1tbiAQYFB2WUDfQpJAABsB
X-Coremail-Antispam: 1Ur529EdanIXcx71UUUUU7IcSsGvfJ3iIAIbVAYjsxI4VWxJw CS07vEb4IE77IF4wCS07vE1I0E4x80FVAKz4kxMIAIbVAFxVCaYxvI4VCIwcAKzIAtYxBI daVFxhVjvjDU=
Archived-At: <https://mailarchive.ietf.org/arch/msg/alto/Mt-3hd-_qxzqSMKWE9RK8inCuvE>
Subject: Re: [alto] Roman Danyliw's No Objection on draft-ietf-alto-new-transport-21: (with COMMENT)
X-BeenThere: alto@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Application-Layer Traffic Optimization \(alto\) WG mailing list" <alto.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/alto>, <mailto:alto-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/alto/>
List-Post: <mailto:alto@ietf.org>
List-Help: <mailto:alto-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/alto>, <mailto:alto-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 03 Jan 2024 12:07:00 -0000

Hi Roman,

Thanks for the update. We adopt the nits and propose the following text in Sec 9:

Additionally, operators of the ALTO servers MUST follow the guidelines in [RFC9325]
to avoid new TLS vulnerabilities discovered after [RFC7285] was published.

Please let us know if that makes sense. Thanks!

Best,
Kai


> -----Original Messages-----
> From: "Roman Danyliw via Datatracker" <noreply@ietf.org>
> Send time:Wednesday, 01/03/2024 04:49:26
> To: "The IESG" <iesg@ietf.org>
> Cc: draft-ietf-alto-new-transport@ietf.org, alto-chairs@ietf.org, alto@ietf.org, mohamed.boucadair@orange.com, mohamed.boucadair@orange.com
> Subject: Roman Danyliw's No Objection on draft-ietf-alto-new-transport-21: (with COMMENT)
> 
> Roman Danyliw has entered the following ballot position for
> draft-ietf-alto-new-transport-21: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
> for more information about how to handle DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-alto-new-transport/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thank you to Donald Eastlake for the SECDIR review.
> 
> Thanks for addressing my DISCUSS feedback.
> 
> ** Section 6.2.  Editorial. New text was added clarifying text to prescribe
> that TIPS view URI must not be reused.  I would recommend being a clearer on
> this language.
> 
> OLD
>       A server MUST NOT use a URI for different TIPS views, either for
>       different resources or different request bodies to the same
>       resource.
> NEW
> A server MUST NOT use the same URI for different TIPS views, either for
> different resources or different request bodies to the same      resource.
> 
> ** Section 9.
>    The security considerations (Section 15 of [RFC7285]) of the base
>    protocol fully apply to this extension.  For example, the same
>    authenticity and integrity considerations (Section 15.1 of [RFC7285])
>    still fully apply;
> 
> Since ALTO TIPS is a new protocol mechanism is it possible to improve on the
> TLS guidance in Section 8.3.5 of RFC7295 (from circa 2014)?  Specifically, can
> RFC9325 be mandated?
> 
>

v2.23.0 | Report a Bug | By Email