Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09

[Lou Berger <[e-mail]>]

Hi Ethan,

On 5/15/2020 1:09 PM, Grossman, Ethan A. wrote:
> Hi Lou,
> As I understand it, there are two unresolved issues from David Black's last email. These are:
>
>> [5-Major] Section 5.8 seems incomplete.   It contains a sizeable summary table
>> of attacks, impacts and mitigations, but doesn't provide
>> recommendations on what to do.  Scanning the mitigations column, a
>> good start would be to characterize control message protection and
>> performance analytics as [MUST implement, SHOULD use] and the combination of DetNet authentication and
>> integrity protection as [MUST implement, MAY use].   Both "MUST"
>> requirements are my initial take that I'd be happy to discuss further.

There were two points on this, in david's response.

1) there was agreement that conformance language was *not* needed, but that

2) the draft should "provide concise recommendations to implementers on 
what to do."

I took this as an editorial comment that the authors would address.  Do 
you think otherwise?

>> [6-Major] Section 7.1 on the IP data plane seems rather weak - I'm not
>> sure whether it says anything that's seriously useful.  Section 7.2 on
>> the MPLS data plane is much better in directing the reader to relevant
>> security considerations in other documents.
> In short, yes, I still need input on these; I can't resolve them myself.

Skimming this section the biggest omissions are  security considerations 
in prior work. I think it worth while to review the security 
considerations in [RFC2474] and [RFC2475] and see if content is missing 
from this document (probably in section 3) or if a simple reference 
should be added.  Once this is done,  I can also note in the 
Shepherd/PROTO write-up that this document has already been informally 
reviewed by the security directorate and that this section has been 
identified as needing specific review (in the context of the rest of the 
document).

So I think the action is back on you/the authors to look at the security 
considerations in [RFC2474] and [RFC2475], update this draft 
accordingly, and then report back to the WG. Of course if someone else 
wishes they can propose a specific update to the WG document on the 
list, and this would be most welcome.

Does this work for you and the other authors?

Thanks,

Lou

> Ethan (as DetNet Security draft editor).
>
>
> -----Original Message-----
> From: Lou Berger <[e-mail]>
> Sent: Friday, May 15, 2020 7:43 AM
> To: DetNet WG <[e-mail]>
> Cc: [e-mail]
> Subject: Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09
>
> To follow up on this LC -- the LC is closed, but (as I understand it) there is one unresolved issue.
>
> Authors,
>
>       do you have a plan to address the open issue, or do you still need some additional input?
>
> Lou
>
> On 4/20/2020 11:00 AM, Lou Berger wrote:
>> All,
>>
>> This starts a two-week working group last call for
>> draft-ietf-detnet-security-09
>>
>> The working group last call ends on April 4.
>> Please send your comments to the working group mailing list.
>>
>> Positive comments, e.g., "I've reviewed this document and believe it
>> is ready for publication", are welcome!
>> This is useful and important, even from authors.
>>
>> Thank you,
>> Lou (DetNet Co-Chair & doc Shepherd)
>>
>> _______________________________________________
>> detnet mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/detnet
>>
> _______________________________________________
> detnet mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/detnet