Re: [dtn] BPSec optional Security Source

["Birrane, Edward J." <[e-mail]>]

Brian,

  I agree that it is a little inefficient to include a security source EID in a security block when that EID is the exact same as the bundle source.  However, I would prefer to not have BPSec prohibit this duplication.

  BPSec states that if a security source EID is not present, then "the source MUST be inferred from other information, such as the bundle source, previous hop, or other values defined by security policy."

  What if local policy on a BPA requires that, absent an asserted security source EID, the security source EID should be inferred as being the previous hop? In such a case, omitting the security source because it was the same as the bundle source would result in undesired behavior.

  Omitting a security source EID should be done when the security source node "believes the network can infer the security source correctly" which is different than saying "whenever it is the same as the bundle source".  In many cases those two statements have the same practical result, but not in every case.

-Ed

---
Edward J. Birrane, III, Ph.D.
Embedded Applications Group Supervisor
Space Exploration Sector
Johns Hopkins Applied Physics Laboratory
(W) 443-778-7423 / (F) 443-228-3839


From: Brian Sipos <[e-mail]>
Sent: Wednesday, December 16, 2020 11:55 AM
To: [e-mail]; Birrane, Edward J. <[e-mail]>
Subject: [EXT] BPSec optional Security Source

APL external email warning: Verify sender [e-mail]<mailto:[e-mail]> before clicking links or attachments



Ed,
My interpretation of the purpose of the ASB Security Source field is to indicate the EID only if it's different than the bundle's source, but there's no actual requirement that I can see in the spec about this. Does it seem like a reasonable statement to say something like "If the security source EID is the same as the bundle source EID, as identified in the primary block, the Security Source field SHALL NOT be included in the ASB." but rephrased as needed?
Thanks,
Brian S.