Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09

Hi Lou,
Comments inline. 
Ethan (EAG).

-----Original Message-----
From: Lou Berger <lberger@labn.net> 
Sent: Friday, May 15, 2020 12:47 PM
To: Grossman, Ethan A. <eagros@dolby.com>; DetNet WG <detnet@ietf.org>
Cc: draft-ietf-detnet-security@ietf.org; Black, David <David.Black@dell.com>
Subject: Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09

Hi Ethan,

On 5/15/2020 1:09 PM, Grossman, Ethan A. wrote:
> Hi Lou,
> As I understand it, there are two unresolved issues from David Black's last email. These are:
>
>> [5-Major] Section 5.8 seems incomplete.   It contains a sizeable summary table
>> of attacks, impacts and mitigations, but doesn't provide 
>> recommendations on what to do.  Scanning the mitigations column, a 
>> good start would be to characterize control message protection and 
>> performance analytics as [MUST implement, SHOULD use] and the combination of DetNet authentication and
>> integrity protection as [MUST implement, MAY use].   Both "MUST"
>> requirements are my initial take that I'd be happy to discuss further.

There were two points on this, in david's response.

1) there was agreement that conformance language was *not* needed, but that

2) the draft should "provide concise recommendations to implementers on what to do."

I took this as an editorial comment that the authors would address.  Do you think otherwise?

EAG: That is exactly how I take it; the issue is that I cannot find an author who is both willing and able to address this. In other words, I don't have the domain knowledge to "tell implementers what to do", and so far no-one else has stepped up. 

>> [6-Major] Section 7.1 on the IP data plane seems rather weak - I'm 
>> not sure whether it says anything that's seriously useful.  Section 
>> 7.2 on the MPLS data plane is much better in directing the reader to 
>> relevant security considerations in other documents.
> In short, yes, I still need input on these; I can't resolve them myself.

Skimming this section the biggest omissions are  security considerations in prior work. I think it worth while to review the security considerations in [RFC2474] and [RFC2475] and see if content is missing from this document (probably in section 3) or if a simple reference should be added.  Once this is done,  I can also note in the Shepherd/PROTO write-up that this document has already been informally reviewed by the security directorate and that this section has been identified as needing specific review (in the context of the rest of the document).

So I think the action is back on you/the authors to look at the security considerations in [RFC2474] and [RFC2475], update this draft accordingly, and then report back to the WG. Of course if someone else wishes they can propose a specific update to the WG document on the list, and this would be most welcome.

Does this work for you and the other authors?

EAG: OK, regarding item #6 I can read the Security sections of RFCs 2474 and 2475 and incorporate what is relevant from them, or include a reference to them. Regarding item #5, I am still at an impasse unless I have specific actionable guidance such as what you have proposed for #6; if you can point me in a specific direction, and I can understand what is being asked (within a reasonable amount of study time), then I am willing to do the work. 

Thanks,

Lou

> Ethan (as DetNet Security draft editor).
>
>
> -----Original Message-----
> From: Lou Berger <lberger@labn.net>
> Sent: Friday, May 15, 2020 7:43 AM
> To: DetNet WG <detnet@ietf.org>
> Cc: draft-ietf-detnet-security@ietf.org
> Subject: Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09
>
> To follow up on this LC -- the LC is closed, but (as I understand it) there is one unresolved issue.
>
> Authors,
>
>       do you have a plan to address the open issue, or do you still need some additional input?
>
> Lou
>
> On 4/20/2020 11:00 AM, Lou Berger wrote:
>> All,
>>
>> This starts a two-week working group last call for
>> draft-ietf-detnet-security-09
>>
>> The working group last call ends on April 4.
>> Please send your comments to the working group mailing list.
>>
>> Positive comments, e.g., "I've reviewed this document and believe it 
>> is ready for publication", are welcome!
>> This is useful and important, even from authors.
>>
>> Thank you,
>> Lou (DetNet Co-Chair & doc Shepherd)
>>
>> _______________________________________________
>> detnet mailing list
>> detnet@ietf.org
>> https://www.ietf.org/mailman/listinfo/detnet
>>
> _______________________________________________
> detnet mailing list
> detnet@ietf.org
> https://www.ietf.org/mailman/listinfo/detnet