[Dots] DOTS secure transport discussion - introducing SSLS

[Robert Moskowitz <[e-mail]>]

I find the DOTS requirements for message transport interesting and 
somewhat unique:

1)    Secure, of course.
2)    Perform well in the face of high congestion, typically on the 
receive link.
3)    Bi-directional.  Actually tightly linked uni-directional flows.
         That is peered more than client/server (despite clear 
cleint/server roles).
4)    Reduce communication stack fate-sharing to reduce attack surface.
5)    Easily restartable during an attack. (recovery after agent 
failure/reboot)


I can, and will if called on it, go through my logic in saying that TLS 
over TCP is not a good tool and even DTLS over UDP misses the mark.  ESP 
in transport mode comes close, but we can do better.

I have put this in:

https://www.ietf.org/internet-drafts/draft-moskowitz-dots-ssls-02.txt

DOTS Secure Session Layer Services

This introduces a real session layer, something really not present in 
the IETF stack, that provides a set of services.  SSLS and its services 
are laid out in:

https://www.ietf.org/internet-drafts/draft-hares-i2nsf-ssls-00.txt

Sue (and I) put the design for SSLS in i2nsf, as it is broadly 
applicable in a number of areas under i2nsf.  This includes i2rs and 
what I have called firstMILE (more on this shortly oer on MILE list).

Two other drafts that fit into this architecture are:

https://www.ietf.org/internet-drafts/draft-moskowitz-sse-03.txt
and
https://www.ietf.org/internet-drafts/draft-moskowitz-gpcomp-00.txt

SSLS (and SSE and GPComp) can use either IKEv2 or HIPv2 (or HIP-DEX) as 
the KMP to establish paired, tightly coupled uni-directional Security 
Associations.

By operating above the transport (TCP,UDP, SCTP, SMS, etc.) the security 
state is independent of transport setup and teardown.  SLS can even 
choose which transport to use under whatever knowledge it has of the 
condition and needs of the time.  It can support multiple, simultaneous, 
communication channels (fully leveraging SCTP for i2rs).

The work on SLS is not done.  A few of us have been working on it for a 
year, but only recently have the pieces fallen together.  SSE is ESP 
moved up the stack and I know of one non-public use of it. GPComp is 
IPCOMP moved up the stack and knowledge of which compression algorithm 
not advertised in each datagram.  Those are really the easy parts.  The 
KMP part is not a stretch.  Both IKE and HIP are higher layer KMPs and 
can be set up to be called as needed. But some work is needed still.

SLS is the new component.  The i2nsf-ssls draft needs clean up; I expect 
it to be further along by IETF (though not postable).

SO.....

I open the floor to discussion.

I would be interested in how others see using existing communication 
services to meet the DOTS requirements.

I am interested in how others see SLS and particularly SSLS and its use 
for DOTS.  I have a slot in the meeting, but I hope by that friday we 
have shaped some positions on this area.

Robert Moskowitz