Re: [dtn] BPbis - mandatory BPsec

["R. Atkinson" <[e-mail]>]

All,

The usual and decades-long IETF practice is that “security is mandatory to implement, but optional to use”.

If security is NOT mandatory to implement, then experience shows it is unlikely to be widely available for users (or sessions) who wish to use security.

All that noted, I think Edward Birrane at JHU/APL had a possibly useful construct:
% I agree that a BPA which does not source, verify, or accept security blocks 
% does not need to implement BPSec.

I would invert that sentence, but (I think) keep the same intention.  I propose adding the quoted two sentences just below to the Security Considerations:

“A Bundle Protocol Agent (BPA) which sources, verifies, and/or accepts a Bundle MUST IMPLEMENT support for BPsec.  Use of BPsec for a particular Bundle Protocol session is optional.”

This means that any BPA which doesn’t provide any of those (source/verify/accept) services need not implement BPsec.  For example, a pure forwarder would not need to implement BPsec.

The text above tries to crisply differentiate implementation from actual use by any particular BP session, in part because long-standing IETF practice is to levy requirements on implementations but (generally) avoid specifying mandatory operational practices (e.g., RPF filtering for IP routes is a BCP but is not a hard requirement.)  

In the context of BP and DTN, it is easy to imagine deployments/environments where high-assurance link-layer communications security might be provided, thereby significantly reducing the potential value of BPsec for a given BP session.

I think the text above will go a long way towards keeping the IETF Security Area happy and greatly reducing the chances of security-related objections during the approval process.

I really think some form of “mandatory to implement” text for BPsec is important.

Yours,

Ran

> On Jul 28, 2020, at 20:49, Burleigh, Scott C (US 312B) <scott.c.burleigh=[e-mail]> wrote:
> 
> Hi.  At IETF-108 there was discussion on whether implementation of the BPsec security extensions should be mandatory in every BP node.  Version 26 of the BPbis I-D (now posted) includes some revision to the first paragraph of section 9.0 to address this question.  It would be helpful to discover the WG consensus on this matter.
>  
> Please use this thread for your comments.
>  
> Scott
> _______________________________________________
> dtn mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtn