Re: [i2rs] Alissa Cooper's Discuss on draft-ietf-i2rs-protocol-security-requirements-11: (with DISCUSS and COMMENT)

["Susan Hares" <[e-mail]>]

Alissa: 

Thank you for taking time to make further comments.   You caught 6 things
I'd missed.  I've submitted a version 12 to resolve all these issues.  I've
attached pdf with the differences.  Please let me know if you find anything
else. 

Sue 

-----Original Message-----
From: i2rs [mailto:[e-mail]] On Behalf Of Alissa Cooper
Sent: Monday, September 26, 2016 3:07 PM
To: The IESG
Cc: [e-mail]; [e-mail]; [e-mail];
[e-mail]
Subject: [i2rs] Alissa Cooper's Discuss on
draft-ietf-i2rs-protocol-security-requirements-11: (with DISCUSS and
COMMENT)

Alissa Cooper has entered the following ballot position for
draft-ietf-i2rs-protocol-security-requirements-11: Discuss

When responding, please keep the subject line intact and reply to all email
addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-i2rs-protocol-security-requireme
nts/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thanks for resolving my previous DISCUSS point. I have just one further
point that hopefully will be easy to fix: Section 3.2 trails off in
mid-sentence.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

#1
>= Section 1 =
>
>The abstract talks about multi-headed writes but Section 1 talks about
multi-headed reads -- I'm assuming these are supposed to be aligned.

[Sue]: Good catch.  It is multi-headed writes in both cases. 

#2  Section 3.1 =
>
>"I2RS also requires a secure transport protocol and key distribution
> protocols."
>
>This is the first sentence of the section -- what does the "also" refer to?

[Sue]: Good catch.  I've removed the also. 

#3) "The following protocols will need to be extended to provide
   confidentiality, data integrity, peer authentication, and key
   distribution protocols: SSH, SCTP, or the ForCES TML layer over SCTP."

>I'm a little confused by the implications of "will need to be extended."
>Is this document proposing that they be extended? Or is the idea that if
any of these protocols is chosen as a transport for I2RS, they would need to
>be extended to meet the I2RS security requirements? Also, note the
existence of draft-ietf-tsvwg-sctp-dtls-encaps-09.

Answer:  Good catch.  I left out a protocol name. The two protocols are
IPFIX and ForCES TML Layer.   Both will need extensions to run over a secure
transport (TLS or DTLS).   

Here's the new text: 

The following protocols will need to be extended to provide 
   confidentiality, data integrity, peer authentication, and key
distribution 
   protocols: IPFIX (over SCTP, TCP or UDP) and ForCES TML layer (over
SCTP).
   These protocols will need extensions to run over a secure transport (TLS
or DTLS)   
   (see section 3.3 for details).


#4
= Section 3.2 =

>"The last new security feature is the ability to allow non-
>   confidential data to be transfered over a non-secure transport."
>
>How is this a security feature?
(smile) 

New: 
The last new feature related to I2RS security is the ability to allow
non-confidential 
 data to be transferred over a non-secure transport.

#5 >= Section 3.3 =
>
>I'm not sure what "options described above" is referring to.

Thank you for letting me know.   I've included the details on the 
extensions for DTLS in the text. 

[replay protection and anti-DoS stateless cookie mechanism]. 

#6 = Section 4 =

>"Data passed over the insecure
>  transport channel MUST not contain any data which identifies a person
>  or any "write" transactions."
>
>Assuming this should say "MUST NOT".

Thank you for catching this point. 

_______________________________________________
i2rs mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/i2rs