Re: [Dots] WGLC on draft-ietf-dots-architecture-08

"Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com> Thu, 29 November 2018 16:03 UTC

Return-Path: <TirumaleswarReddy_Konda@mcafee.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30A06130E05 for <dots@ietfa.amsl.com>; Thu, 29 Nov 2018 08:03:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.761
X-Spam-Level:
X-Spam-Status: No, score=-5.761 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.46, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ws6YSmmWA24e for <dots@ietfa.amsl.com>; Thu, 29 Nov 2018 08:03:45 -0800 (PST)
Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 929771271FF for <dots@ietf.org>; Thu, 29 Nov 2018 08:03:45 -0800 (PST)
X-NAI-Header: Modified by McAfee Email Gateway (5500)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1543507442; h=From: To:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:x-originating-ip: x-ms-publictraffictype:x-microsoft-exchange-diagnostics: x-ms-exchange-antispam-srfa-diagnostics:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: authentication-results:x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck:x-exchange-antispam-report-cfa-test: x-forefront-prvs:x-forefront-antispam-report: received-spf:x-microsoft-antispam-message-info: spamdiagnosticoutput:spamdiagnosticmetadata: Content-Type:Content-Transfer-Encoding:MIME-Version: X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=1HeK28f6PG7gT0akN9E86j1GPZe0XdOPc6rgPP 6+4ec=; b=E6aqoD29dZJ7KjlFwZ8RVVwC8u2AiesQBAJdHMfe l7HYZR4FUuzVq726IAy8VTKmxk+Rb+sFPjH1u4yeNKY7XfTc7G s1cEDNx5H+yMzX7EtFsKAwOY8HagoFSz5LDnehGW/0fM/R7BNr ISkYb9rHKIMI0cY0E44roqNUD9PmNcI=
Received: from DNVEXAPP1N04.corpzone.internalzone.com (unknown [10.44.48.88]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 2400_1256_9cd63974_97c4_41b6_bee7_9d4e79e19393; Thu, 29 Nov 2018 10:04:02 -0600
Received: from DNVEXUSR1N08.corpzone.internalzone.com (10.44.48.81) by DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Thu, 29 Nov 2018 09:02:53 -0700
Received: from DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) by DNVEXUSR1N08.corpzone.internalzone.com (10.44.48.81) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Thu, 29 Nov 2018 09:02:53 -0700
Received: from DNVO365EDGE2.corpzone.internalzone.com (10.44.176.74) by DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) with Microsoft SMTP Server (TLS) id 15.0.1347.2 via Frontend Transport; Thu, 29 Nov 2018 09:02:52 -0700
Received: from NAM05-BY2-obe.outbound.protection.outlook.com (10.44.176.240) by edge.mcafee.com (10.44.176.74) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Thu, 29 Nov 2018 09:02:51 -0700
Received: from BN6PR16MB1425.namprd16.prod.outlook.com (10.172.207.19) by BN6PR16MB1650.namprd16.prod.outlook.com (10.172.27.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1361.16; Thu, 29 Nov 2018 16:02:50 +0000
Received: from BN6PR16MB1425.namprd16.prod.outlook.com ([fe80::b8de:7bb:cfa3:22ee]) by BN6PR16MB1425.namprd16.prod.outlook.com ([fe80::b8de:7bb:cfa3:22ee%8]) with mapi id 15.20.1361.019; Thu, 29 Nov 2018 16:02:50 +0000
From: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>
To: "mohamed.boucadair@orange.com" <mohamed.boucadair@orange.com>, Roman Danyliw <rdd@cert.org>, "dots@ietf.org" <dots@ietf.org>
Thread-Topic: WGLC on draft-ietf-dots-architecture-08
Thread-Index: AdSGnlgla3cLRB5MRLWQWFaJSQftBABEEW3wAAZceYAAB9nNYAAEkILw
Date: Thu, 29 Nov 2018 16:02:50 +0000
Message-ID: <BN6PR16MB1425D2A6BED037A18098CF54EAD20@BN6PR16MB1425.namprd16.prod.outlook.com>
References: <359EC4B99E040048A7131E0F4E113AFC0184C49169@marathon> <787AE7BB302AE849A7480A190F8B93302E04F649@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <BN6PR16MB1425AD85A67FFE5A0EA5A769EAD20@BN6PR16MB1425.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302E04F981@OPEXCLILMA3.corporate.adroot.infra.ftgroup>
In-Reply-To: <787AE7BB302AE849A7480A190F8B93302E04F981@OPEXCLILMA3.corporate.adroot.infra.ftgroup>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.1.0.61
dlp-reaction: no-action
x-originating-ip: [185.221.69.46]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; BN6PR16MB1650; 6:EWPmo4DRhXYx0jfy6NDPX8NrSPO/9IjWY4S+lH3TpFYUokEtoeGChom+oUeCPxq6IuvYBb16pB4v90cHdcDaMIlXW/wjD2uuwFxariVq2UD0MBfygVTc9S/BKJiKgZCUpQJu+56esfEkORfplOOtX77Ymwldy4sSZzSWhOO2ycYfiUCmNdbqNw2bPSYbnVZ49n218r5Nc239VxFMmcNCEVBmamMswgD+4kElErdJ5VBPuA/DrPyX82NSkMK+JpzDzILrBMx17C6Vvo8Of4iTT8K7yUJsLqD0C5ueiuqdzLvxYgzczCIpB3xUdINYHFTBjJauZy28Q6alI9FiZA1fIRA7RZrmhF73tGMiWE2Y576GbojVoajxId5u1Yf0YriDgDEmY3c9NlRMlnHhjMWab5e6bd6doQVdBaPQ9FF6zH75d87H7GHDjoe59LSUYmjK9fpRhiTewg3pVCjV5Hkzyw==; 5:mxjNUOUI1xoboTXZ4KUUsDGwiTlAYOYuPFPTwddVB9lcy0tTJuZcqoeBEn4rRlfYnlR2TRq8vxuqIKNbv4KA0KinK6HYjLiO2A5twXkqyjRbHAmaguF79A9zgFJgLP1laqRlq8N9AReGm+w4oXSrgH42YJKAYcnZ54vKseQcb14=; 7:Oh//5fFX7ISg8H4/ZQARQ1fg9aQhF34+NOS2sB0Jg3vLiO9vEi1vfQGJM/UMzA1vPy/jL1wE9KDkCghnOiLQQfsunxusMKyv5yWPjR3NG9XIRCmoTJDfr75hWA99FxusoX6z3LP9+Fp5YVaSkRfsTg==
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 95d91bed-1e01-4367-682a-08d656141cd4
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390098)(7020095)(4652040)(8989299)(5600074)(711020)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:BN6PR16MB1650;
x-ms-traffictypediagnostic: BN6PR16MB1650:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com;
x-microsoft-antispam-prvs: <BN6PR16MB1650E16E40BA04FF8500294FEAD20@BN6PR16MB1650.namprd16.prod.outlook.com>
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3231453)(999002)(944501447)(52105112)(93006095)(93001095)(3002001)(10201501046)(148016)(149066)(150057)(6041310)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699051)(76991095); SRVR:BN6PR16MB1650; BCL:0; PCL:0; RULEID:; SRVR:BN6PR16MB1650;
x-forefront-prvs: 0871917CDA
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(346002)(136003)(39860400002)(376002)(396003)(199004)(189003)(32952001)(55784004)(13464003)(106356001)(14454004)(110136005)(53936002)(9686003)(93886005)(55016002)(3846002)(68736007)(6306002)(105586002)(316002)(14444005)(256004)(5024004)(66066001)(6116002)(305945005)(478600001)(6246003)(2906002)(26005)(72206003)(966005)(186003)(486006)(25786009)(6506007)(97736004)(53546011)(86362001)(446003)(71190400001)(229853002)(71200400001)(7736002)(6436002)(11346002)(33656002)(7696005)(76176011)(102836004)(81156014)(74316002)(81166006)(8676002)(5660300001)(2501003)(8936002)(476003)(80792005)(99286004)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BN6PR16MB1650; H:BN6PR16MB1425.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: ZM5tJOHnZj79voPchZrizw4VHchvO5vUJ8k/i7zBlYtu1DK0Br12YixO2lANIV4kzR7cNuhTce2Zyq/5KKSSm7vG5+Bd8IS54xBrFv2j512nqDB757eedwMCad8JGFzhcdjThNqADQWkPSUYvydEOehbM+TkRYMAsDVtWCH5Tjve67ZMqu3zUKl4vBtAUFSUoD78lFIAu3aJVmvY+R//5qCO8TCF4uqa4Ya7gg97wWs7pHD2O5PrWn73pPi8MdPIbaKoAPtMmrPV0g4HVXvj8VvQJk3uT7+B2qgghvAq/GUkCk4t3usp0997OPS7oSa4C35XAEG1nRTGPSLHXuvHoLtRoFueORZFcs5cOV69/qc=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 95d91bed-1e01-4367-682a-08d656141cd4
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Nov 2018 16:02:50.1309 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR16MB1650
X-OriginatorOrg: mcafee.com
X-NAI-Spam-Flag: NO
X-NAI-Spam-Level:
X-NAI-Spam-Threshold: 15
X-NAI-Spam-Score: 0.1
X-NAI-Spam-Version: 2.3.0.9418 : core <6429> : inlines <6974> : streams <1805685> : uri <2757644>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/6AzCNeRxBSwQ76KoXQb0rRBMktI>
Subject: Re: [Dots] WGLC on draft-ietf-dots-architecture-08
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Nov 2018 16:03:49 -0000

> -----Original Message-----
> From: mohamed.boucadair@orange.com <mohamed.boucadair@orange.com>
> Sent: Thursday, November 29, 2018 7:35 PM
> To: Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>;
> Roman Danyliw <rdd@cert.org>; dots@ietf.org
> Subject: RE: WGLC on draft-ietf-dots-architecture-08
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> Tiru,
> 
> Please see inline.
> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Konda, Tirumaleswar Reddy
> > [mailto:TirumaleswarReddy_Konda@McAfee.com]
> > Envoyé : jeudi 29 novembre 2018 14:25
> > À : BOUCADAIR Mohamed TGI/OLN; Roman Danyliw; dots@ietf.org Objet :
> > RE: WGLC on draft-ietf-dots-architecture-08
> >
> >
> >
> > > -----Original Message-----
> > > From: Dots <dots-bounces@ietf.org> On Behalf Of
> > > mohamed.boucadair@orange.com
> > > Sent: Thursday, November 29, 2018 2:01 PM
> > > To: Roman Danyliw <rdd@cert.org>; dots@ietf.org
> > > Subject: Re: [Dots] WGLC on draft-ietf-dots-architecture-08
> > >
> > >
> > >
> > > Hi Roman, all,
> > >
> > > I support this draft to be sent to the IESG for publication.
> > >
> > > Some easy-to-fix comment, though:
> > >
> > > (1) The document cites [I-D.ietf-dots-requirements] in may
> > > occurrences. I suggest these citations to be more specific, that is
> > > to point the specific
> > REQ# or
> > > the section. Doing so would help readers not familiar with DOTS
> > > documents
> > to
> > > easily link the various pieces.
> > >
> > > (2) I used to point people to the DOTS architecture I-D when I
> > > receive comments/questions about the notion of "DOTS session" and to
> > > the Requirements I-D for clarification about DOTS channels. It seems
> > > that some clarifications are needed in the architecture I-D to
> > > explain for readers
> > not
> > > familiar with all DOTS documents, for example:
> > > - the link with the underlying transport sessions/connections and
> > > security associations.
> > > - mitigations are not bound to a DOTS session but to a DOTS client/domain.
> > >
> > > (3) The signal channel I-D uses "DOTS signal channel session", "DOTS
> > > signal channel sessions" and "DOTS data channel session" to refer to
> > > specific DOTS sessions. I'd like to have these terms introduced also in the
> arch I-D.
> > >
> > > BTW, the signal channel uses in few occurrences "DOTS session";
> > > those can
> > be
> > > changed to "DOTS signal channel session". There is no occurrence of
> > > "DOTS session" in the data channel I-D.
> >
> > I don't see a need to modify the "DOTS session" discussed in the
> > signal channel draft,
> > https://tools.ietf.org/html/draft-ietf-dots-architecture-
> > 07#section-3.1 defines the term "DOTS session".
> 
> [Med] I used to had the same opinion till recently. The comments I'm getting
> from people is that the articulation between the various terms is not that clear.
> We collectively need to double check this and make required changes,
> including simplifying the terminology. We are using the following terms in the
> various I-Ds:
> 
> * DOTS session
> * DOTS signal channel
> * DOTS data channel
> * DOTS signal channel session
> * DOTS data channel session
> * established signal channel
> * established data channel
> 
> For example, having both "DOTS signal channel session" and "DOTS session"
> terms in the signal channel I-D to refer to the same thing can be avoided.

Sure, let's use the term "DOTS signal channel session" in the signal channel I-D. 

> 
>  However, I agree with your
> > comments to update the section 3.1 to add the following lines:
> > Mitigation requests created using a DOTS session are not bound to the
> > DOTS session. Mitigation requests are associated with a DOTS client
> > and can be managed using different DOTS sessions. A DOTS session is
> > associated with a single transport connection (e.g. TCP or UDP
> > session) and an ephemeral security association (e.g. a TLS or DTLS session).
> 
> [Med] This is a good starting point. Some part of the text is more accurate with
> s/DOTS session/DOTS signal channel session.

Sure, Works for me.

> 
> >
> > The DOTS signal data channel session is a mutually authenticated DOTS
> > session between DOTS agents.
> >
> 
> [Med] I guess you meant s/signal data channel/signal channel. 

I don't see the need for the above line, if we add the following line:
 A DOTS signal channel session is associated with a single transport connection (e.g. TCP or UDP session) and an ephemeral security association (e.g. a TLS or DTLS session).

> Putting that
> aside, and more importantly, a reader will then have troubles to parse the
> following:
> 
> "Conversely, a
>    DOTS session cannot exist without an established signal channel: when
>    an established signal channel is terminated for any reason, the DOTS
>    session is also said to be terminated."

Removing the above line should avoid the confusion.

-Tiru

> 
> 
> > DOTS data channel draft is not using the term "DOTS data channel
> > session", we can fix the signal channel draft to use "DOTS data
> > channel" instead of "DOTS data channel session".
> >
> 
> [Med] May be. BTW, this part of the text:
> 
> " Conversely, a
>    DOTS session cannot exist without an established signal channel "
> 
> is conflicting with this one:
> 
> "
> To allow for DOTS
>    service flexibility, neither the order of contact nor the time
>    interval between channel creations is specified.  A DOTS client MAY
>    establish signal channel first, and then data channel, or vice versa."
> 
> > Cheers,
> > -Tiru
> >
> > >
> > > Thank you.
> > >
> > > Cheers,
> > > Med
> > >
> > > > -----Message d'origine-----
> > > > De : Dots [mailto:dots-bounces@ietf.org] De la part de Roman
> > > > Danyliw Envoyé : mardi 27 novembre 2018 23:15 À : dots@ietf.org
> > > > Objet : [Dots] WGLC on draft-ietf-dots-architecture-08
> > > >
> > > > Hello!
> > > >
> > > > Consistent with our discussion at the Bangkok meeting, we are
> > > > starting a working group last call (WGLC) for the DOTS architecture draft:
> > > >
> > > > DOTS Architecture
> > > > draft-ietf-dots-architecture-08
> > > > https://tools.ietf.org/html/draft-ietf-dots-architecture-08
> > > >
> > > > Please send comments to the DOTS mailing list -- feedback on
> > > > remaining issues or needed changes; as well as endorsements that
> > > > this draft is
> > ready.
> > > >
> > > > This WGLC will end on December 12, 2018.
> > > >
> > > > Thanks,
> > > > Roman and Frank
> > > >
> > > > _______________________________________________
> > > > Dots mailing list
> > > > Dots@ietf.org
> > > > https://www.ietf.org/mailman/listinfo/dots
> > >
> > > _______________________________________________
> > > Dots mailing list
> > > Dots@ietf.org
> > > https://www.ietf.org/mailman/listinfo/dots