Re: [Dots] Éric Vyncke's No Objection on draft-ietf-dots-architecture-16: (with COMMENT)

["Eric Vyncke (evyncke)" <[e-mail]>]

Tiru,

Thank you for the prompt reply.

My comments/questions were not blocking but I appreciate your reply.

Regards

-éric


From: iesg <[e-mail]> on behalf of tirumal reddy <[e-mail]>
Date: Tuesday, 4 February 2020 at 04:13
To: Eric Vyncke <[e-mail]>
Cc: Roman Danyliw <[e-mail]>, Valery Smyslov <[e-mail]>, "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>, The IESG <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: Éric Vyncke's No Objection on draft-ietf-dots-architecture-16: (with COMMENT)

Hi Eric,

Thanks for the review. Please see inline

On Mon, 3 Feb 2020 at 15:48, Éric Vyncke via Datatracker <[e-mail]<mailto:[e-mail]>> wrote:
Éric Vyncke has entered the following ballot position for
draft-ietf-dots-architecture-16: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dots-architecture/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Dear authors,

Thank you for the work put into this document. As a side note, I really liked
the section about the manual/over-the-phone part of it.

Until now, I have read only this document (dots-architecture) from the dots WG,
so, please accept my ignorance for details. But, I have a couple of
non-blocking questions where your reply will be welcome and appreciated:

Q1) is the monetary cost part of the DOTS signaling ? (I.e., the mitigator
telling the target that it will cost so many EUR per hour)

No, monetary cost is not part of the DOTS signaling.


Q2) Using DOTS in an under-attack network, did you consider recommending
dual-stack signaling to cope with the rare case where IPv4 is disrupted while
IPv6 still works (of course if the DoS is plain flooding this won't help a lot
probably; and the dual proposition exists).

Yes, Happy Eyeballs for DOTS signal channel is discussed in https://tools.ietf.org/html/draft-ietf-dots-signal-channel-41#section-4.3


Q3) While I appreciate the value of Anycast DOTS server, hence UDP is mostly
required for signaling transport, I wonder whether the choice of UDP (often
used AFAIK as volumetric attack as it is easier to spoof) is a good choice
compared to TCP or DSCP or ...

Both DTLS over UDP and TLS over TCP is used by the DOTS signal channel (UDP is given higher precedence than TCP).
DTLS is capable of defending against DoS attack by using the stateless cookie mechanism (see https://tools.ietf.org/html/rfc6347#section-4.2.1)


Q4) When having multiple DOTS servers, I assume that the case of a dual-stack
DOTS server is also covered. Therefore, a word on whether Happy Eyeball (RFC
8305) should probably be useful **IF** applicable

Happy Eyeball is discussed in detail in the DOTS signal channel protocol specification.

Cheers,
-Tiru


Regards

-éric

Regards,

-éric