Re: [dhcwg] Ben Campbell's Yes on draft-ietf-dhc-relay-server-security-04: (with COMMENT)

["Ben Campbell" <[e-mail]>]

On 12 Apr 2017, at 17:31, Bernie Volz (volz) wrote:

> Hi:
>
> For:
>
>     -3, third paragraph: "MUST exchange messages securely"
>     "Securely" is too ambiguous for a MUST. What specific protections 
> are
>     required?
>
> I believe this also was the 4th paragraph?

Yes

> I guess there are two choices here:
> 1. Drop “securely” as we are just specifying to use IPsec.
> 2. Replace “securely” with “encrypted and authenticated”.
> Seems to be #1 might be better (as it should be unnecessary given that 
> is what this document is about).

Is ESP with null encryption allowed?

>
>
>      -3, paragraph 4:
>     The list starts with no context. A sentence or paragraph 
> describing the
>     purpose of the list would be helpful.
>
> RFC 3315 had before this list:
>    Relay agents and servers that support secure relay agent to server 
> or
>    relay agent to relay agent communication use IPsec under the
>    following conditions:
>
> But I’m not sure “conditions” is the best word? Not sure if 
> there is a better word to use to describe these items?

Rules? Configuration? (But I don't think "conditions" is awful)

>
> Perhaps replacing the first sentence in that 4th paragraph with:
>
>   Relay agents and servers MUST exchange messages using the
>   IPsec mechanisms described in [RFC4301] with the conditions
>   as follows:
>
> And, move the remaining text in that 4th paragraph to the end of 
> section 4 as a separate paragraph.
>
> - Bernie
>
> On 4/12/17, 4:39 PM, "Ben Campbell" <[e-mail]> wrote:
>
>     Ben Campbell has entered the following ballot position for
>     draft-ietf-dhc-relay-server-security-04: Yes
>
>     When responding, please keep the subject line intact and reply to 
> all
>     email addresses included in the To and CC lines. (Feel free to cut 
> this
>     introductory paragraph, however.)
>
>
>     Please refer to 
> https://www.ietf.org/iesg/statement/discuss-criteria.html
>     for more information about IESG DISCUSS and COMMENT positions.
>
>
>     The document, along with other ballot positions, can be found 
> here:
>     https://datatracker.ietf.org/doc/draft-ietf-dhc-relay-server-security/
>
>
>
>     ----------------------------------------------------------------------
>     COMMENT:
>     ----------------------------------------------------------------------
>
>     I am balloting "Yes", but I share the curiosity about whether 
> people will
>     really do this.
>
>     -3, third paragraph: "MUST exchange messages securely"
>     "Securely" is too ambiguous for a MUST. What specific protections 
> are
>     required?
>
>     -3, paragraph 4:
>     The list starts with no context. A sentence or paragraph 
> describing the
>     purpose of the list would be helpful.