Re: [conex] Stephen Farrell's No Objection on draft-ietf-conex-destopt-09: (with COMMENT)

[Suresh Krishnan <[e-mail]>]

Hi Stephen,

On 10/01/2015 04:31 AM, Stephen Farrell wrote:
>
> Hiya,
>
> On 01/10/15 04:52, Suresh Krishnan wrote:
>> Hi Stephen,
>>     Thanks for your comments. Please find responses inline
>>
>> On 09/30/2015 08:06 PM, Stephen Farrell wrote:
>>> Stephen Farrell has entered the following ballot position for
>>> draft-ietf-conex-destopt-09: No Objection
>>>
>>> When responding, please keep the subject line intact and reply to all
>>> email addresses included in the To and CC lines. (Feel free to cut this
>>> introductory paragraph, however.)
>>>
>>>
>>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>>> for more information about IESG DISCUSS and COMMENT positions.
>>>
>>>
>>> The document, along with other ballot positions, can be found here:
>>> https://datatracker.ietf.org/doc/draft-ietf-conex-destopt/
>>>
>>>
>>>
>>> ----------------------------------------------------------------------
>>> COMMENT:
>>> ----------------------------------------------------------------------
>>>
>>>
>>> - section 7: "If the transport network cannot be trusted, IPsec
>>> Authentication should be used to ensure integrity of the ConEx
>>> information." Hmm. Transport networks cannot be trusted so the
>>> first condition is always met. That means you are saying IPsec
>>> should be used. I don't see how the key management required is
>>> going to happen and even if it did, would that affect conex
>>> calculations? I'm ok with an experiment on that basis though,
>>> but it'd be better if the real relationship between this and IPsec
>>> were more fully fleshed out somewhere as part of the experiment.
>>
>> I am not sure if the form of key management chosen would affect the
>> conex calculations at all.
>
> My point is that the key management implied here is basically not
> going to happen. That means IPsec will not be used and hence conex
> calculations will need to take into account the potential for routers
> to mess with the CDO.
>
> And I think the text of this would be better if it recognised the
> improbability of IPsec being used in the wild, or else spoke to how
> one could arrange experiments so that use of IPsec is more likely.

Thanks. I think it may unfortunately end up being the former. Once the 
audit text is finalized, I will come back with alternate text for this. 
I will keep track of this issue along with Kathleen's DISCUSS as they 
will probably end up needing the same resolution.

Regards
Suresh