Re: [dtn] BPbis - BPSec requirement

[Magnus Westerlund <[e-mail]>]

Hi,

So looking at RFC 3365 which is the BCP that says strong security is required to
provide a solution for Internet. https://datatracker.ietf.org/doc/rfc3365/

I will note that Section 7 is very clear that this is a MUST Implement and not
MUST use. 

So from my perspective to capture the desires you have written and meet the
requirements of the BCP then you should have text in BPbis that says that BPSec
MUST be implemetned. Then it is up to the BP node to not use it if it knows that
it will not needed to for this bundle to the target node. 

What is currently in BPBis is:

9. Security Considerations

   The bundle protocol security architecture and the available security
   services are specified in an accompanying document, the Bundle
   Security Protocol (BPsec) specification [BPSEC].  Whenever Bundle
   Protocol security services (as opposed to the security services
   provided by overlying application protocols or underlying
   convergence-layer protocols) are required, those services SHALL be
   provided by BPsec rather than by some other mechanism with the same
   or similar scope.

Personally I think that is to weak to meet the the requirements of RFC3365. Even
if it is challenging to depoly the key-management aspects of the security
solution I (personal opinion) don't quite see how any environment where BP is
intended to used can be considered a trusted environment where BPSec would not
be needed at least to provide integrity protection. 

So people really have issues with an implementation requirement on BPSec?

Cheers

Magnus




On Mon, 2020-08-03 at 15:14 -0400, Wiethuechter, Adam wrote:
> I also agree with Brian.
> 
> On Tue, Jul 28, 2020 at 6:16 PM <[e-mail]> wrote:
> > I agree 100% with Brian.  BPSec should be the "standard" for bundle-
> > level encryption. 
> > 
> > Ronny
> > 
> > On Tue, 2020-07-28 at 11:52 +0000, Brian Sipos wrote:
> > > All,
> > > My opinion is that BPSec should be required in the sense of: When
> > > bundle-level security is needed, you must use BPSec instead of some
> > > other mechanism with the same or similar scope.
> > > This is the same type of qualified requirement used for TLS in
> > > TCPCLv4.
> > > This requirement steers implementations away from private
> > > encodings/behaviors, which is desirable as Rick mentioned in the
> > > Monday meeting.
> > > 
> > > From: dtn <[e-mail]> on behalf of Rick Taylor <
> > > [e-mail]>
> > > Sent: Monday, July 27, 2020 09:05
> > > To: [e-mail] <[e-mail]>
> > > Subject: [dtn] BPbis - BPSec requirement
> > >  
> > > All,
> > >  
> > > At IETF-108 there was discussion on whether BPbis should require
> > > BPSec, and the chairs are interested in discovering the WG consensus
> > > on this matter.
> > >  
> > > Please use this thread for your comments.
> > >  
> > > Cheers,
> > >  
> > > Rick & Marc
> > > _______________________________________________
> > > dtn mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/dtn
> > 
> > _______________________________________________
> > dtn mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/dtn
> 
> 
> _______________________________________________
> dtn mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtn
-- 
Cheers

Magnus Westerlund 


----------------------------------------------------------------------
Networks, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Torshamnsgatan 23           | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------