[dtn] Éric Vyncke's No Objection on draft-ietf-dtn-bpsec-18: (with COMMENT)

[Éric Vyncke via Datatracker <[e-mail]>]

Éric Vyncke has entered the following ballot position for
draft-ietf-dtn-bpsec-18: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dtn-bpsec/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for the work put into this document.

I hope that this helps to improve the document,

Regards,

-éric

-- Section 2.3 --
About
  "a waypoint node, representing a
   gateway to an insecure portion of the DTN, may receive the bundle and
   choose to apply a confidentiality service"
how could the bundle destination could recover the plain text if there is no
security association with the encrypting waypoint? Or is it simple hop-by-hop
encryption ?

-- Section 3.2 --
Why not supporting multiple integrity-checks/signatures? After all, this would
allow the support of more than 1 integrity check / signature algorithm?
(Obvioulsy, this cannot be done for confidentility -- except if transmitting
multiple copies). There are some text related to this in section 3.7.

-- Section 8.2.4 --
More details about anti-replay of a DTN message would be welcome. E.g., is the
bundle age field used ?

-- Section 9.2 --
This section is a list of issues with BPsec but are there other WG items
attempting to solve those issues ? draft-ietf-dtn-bpsec-interop-sc does not
seem to cover those issues.