Re: [CDNi] Adoption of draft-leung-cdni-uri-signing as a WG document

["Francois Le Faucheur (flefauch)" <[e-mail]>]

On 12 May 2014, at 12:10, <[e-mail]<mailto:[e-mail]>> <[e-mail]<mailto:[e-mail]>> wrote:

Hello IETF-ers,

As previously stated, the current version of the draft is a good starting point.

After a quick chat with one of my colleagues, there are a few aspects that we’d like to mention:


1.       It seems that all CSPs share the same format of the URI signing, which might be a disadvantage as they often seem to have various specific methods. I know we are trying to achieve interoperability, but maybe it would be worth adding another parameter to give more flexibility in the choice of signing method (other than VER that doesn’t seem well suited for this purpose).

If DNS redirection is used, then the dCDNs will see the initial signature applied by the CSP. So the URI signature spec defined by CDNI has to be used by the CSP themselves. I agree that every CSP have their own way to do that today. But to me it means we don;t have much chance of including in our spec the necessary flavors to avid change at the CSP. Given that situation, I think our best bet to maximise interoperability is to define one simple mandatory approach to implement and that all CDNs would support.

If HTTP redirection is used, then the uCDN woudl perform URI resigning. So each CSP can use its own URI signing algorithm (as long as they agree with the uCDN) and then the CDNI URI signing scheme is applied when redirecting to dCDN.



2.       For the objects presented in Section 5.4, I am not sure of my understanding of the set of dCDNs sharing a symmetric key with the uCDN. Can that be a security issue where a dCDN can spoof another dCDN that’s using the same key?

If DNS redirection is used, then all dCDNs need to understand the original signature. If the signature uses symmetric keys , then all dCDNs need to use that same shared key. This is a property of that deployment scenario (ie DNS/symmetric). But yes the security implications need to be discussed.

If HTTP redirection is used, then the expected mode of operator will be that the uCDN performs re-signing after URI rewrite, in which case a different a different symmetric key can be used for each dCDN.

3.       There seems to be a need to include the scenario in which there are several users on a home LAN that are behind a box that does NAT. It would be good to have a way to differentiate each individual request coming from the devices on the same network.

To be picky, maybe the example used in the draft could use an IP address that is in line with RFC 6761 instead of the classic private 10.0.0.1.

Agreed,

Thanks for the review and comments.

Francois


-- iuniana


De : CDNi [mailto:[e-mail]] De la part de Francois Le Faucheur (flefauch)
Envoyé : mercredi 7 mai 2014 15:53
À : [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Objet : Re: [CDNi] Adoption of draft-leung-cdni-uri-signing as a WG document

All,

I incorrectly thought the poll deadline was May 5th, but it was set to May 12th in my poll message below. So just to make sure we are not preventing anyone from posting their feedback, let’s hold off on the announcement below until May 12th. We’ll revaluate the decision then based on additional feedback.

Cheers

Francois

PS: I guess going on holidays can make one lose the notion of time ...

On 7 May 2014, at 15:42, Francois Le Faucheur (flefauch) <[e-mail]<mailto:[e-mail]>> wrote:


Folks,
In addition to the support expressed in London, we’ve heard as a result of the list poll:
* statements of strong support (Kevin, Matt, Scott, Daryl)
* a statement of conditional support (Ben)
* no objection/concern.
So we (WG Chairs) confirm adoption of draft-leung-cdni-uri-signing as a WG document, conditioned to resolution of Ben’s comments.

To draft authors,
Please continue the discussion (on the WG mailer) with Ben to converge on how to best address his comments, and then post a new version of the draft as draft-ietf-cdni-uri-signing-00.

Cheers

Francois

On 25 Apr 2014, at 16:51, Francois Le Faucheur (flefauch) <[e-mail]<mailto:[e-mail]>> wrote:


Folks,

Just to be clear, this is a follow up from Daryl’s earlier message of 25 April (http://www.ietf.org/mail-archive/web/cdni/current/msg01837.html), which issued a similar request. We did not received much feedback so would like to give another opportunity for more feedback.

Francois

Begin forwarded message:


From: "Francois Le Faucheur (flefauch)" <[e-mail]<mailto:[e-mail]>>
Subject: [CDNi] Poll for adoption of draft-leung-cdni-uri-signing-05 as a WG document
Date: 25 April 2014 16:30:08 CEST
To: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>

Folks,

During the London meeting:
* authors confirmed that they believe the latest version of draft-leung-cdni-uri-signing resolved the issue related to draft-ietf-appsawg-uri-get-off-my-lawn-04.txt.
* WG chairs agreed to take to the list the question of adopting draft-leung-cdni-uri-signing-05 as a WG document to ensure it gets sufficient review.

This message is to encourage review of draft-leung-cdni-uri-signing-05 (http://tools.ietf.org/id/draft-leung-cdni-uri-signing-05.txt) and sollicite feedback on adopting it as a WG document to address the corresponding milestone on our charter.
Please do so by end of 12 May (ie within the next 2 weeks).

Francois & Daryl, CDNI WG Chairs



For convenience, quote from IETF-89 CDNI WG meeting minutes :
"
Daryl (as chair): This is a deliverable on our charter, but not many people have read the draft yet, so will take question for WG adoption to the list to give people time to read it.
“


For convenience, relevant excerpt from the CDNI WG charter (http://tools.ietf.org/wg/cdni/charters):
“
The working group will focus on the following items:
<…>
 - A specification for "CDNI URI Signing". This document will specify a
   mechanism that allows interconnected CDNs to support access control
   by signing content URIs. This may involve extensions to the CDNI
   interfaces (e.g. CDNI Metadata interface, CDNI Logging interface).

<…>

Goals and Milestones:
<…>
 Sep 2014 - Submit specification of URI Signing for CDNI to IESG as Proposed Standard
"
_______________________________________________
CDNi mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/cdni

_______________________________________________
CDNi mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/cdni

_______________________________________________
CDNi mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/cdni


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.