Re: [babel] rfc6126bis security implementation requirements

[Donald Eastlake <[e-mail]>]

Hi Juliusz,

A recommendation can be pretty weak depending on what you say about when it
might not be applicable. Let's see if anyone else has comments on this.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   [phone] (cell)
 1424 Pro Shop Court, Davenport, FL 33896 USA
 [e-mail]


On Sat, Nov 10, 2018 at 6:56 AM Juliusz Chroboczek <[e-mail]> wrote:

> > In discussion at the BABEL WG meeting in Bangkok, there appeared to be
> > consensus in the room that rfc6126bis should normatively reference both
> the
> > hmac and the dtls Babel security drafts and should recommend
> implementing both.
> > It should also recommend using hmac unless the additional security
> features of
> > dtls are specifically needed. Neither would be mandatory to implement.
> This
> > email is to confirm that consensus.
>
> I think that what we agreed about is that Babel-HMAC is recommended, both
> for implementation and deployment, and that we (as a group) hold no
> opinion on Babel-DTLS.
>
> The reason we don't want to recommend implementing Babel-DTLS is that it
> is not necessarily trivial to implement: it requires a fair amount of
> hacking to get an implementation to speak unicast, and it imposes
> a dependency on a DTLS stack.
>
> Thus, I think that recommending implementation of Babel-DTLS might reduce
> the applicability of Babel.  Let's recommend Babel-HMAC, and let the
> market choose whether to implement Babel-DTLS.
>
> -- Juliusz
>