IETF Logo Mail Archive

RE: [dhcwg] [Int-dir] Review of draft-ietf-dhc-relay-server-security-02

"Bernie Volz (volz)" <volz@cisco.com> Thu, 26 January 2017 19:18 UTC

Return-Path: <volz@cisco.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C47F1299AD; Thu, 26 Jan 2017 11:18:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.72
X-Spam-Level:
X-Spam-Status: No, score=-17.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ndmJ1COfNDII; Thu, 26 Jan 2017 11:18:11 -0800 (PST)
Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3973F129992; Thu, 26 Jan 2017 11:18:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3294; q=dns/txt; s=iport; t=1485458291; x=1486667891; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=j0dL5zsaMHfEVK9dwPOuj0hzsOEUkp4yaWbQf6OK4pk=; b=c2Lp0l34wo8qcRWNxPpQGFqxMscpGKLJJsLS6J5mm7a9nQvkfWcXURgq vEs0/nIt73ltqCCOT/kZ49QeCKfy1Nx82BDbBfU2ldbCiLRzlW9yRSYdT rPyrl3krRnmpTNbY1wOmSLhwMz7WovpQDleiSoNAVzjWeUk8Bbnpr60Rc Q=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0BlAQARS4pY/5tdJa1eGQEBAQEBAQEBAQEBBwEBAQEBgzUBAQEBAR+BageDTooJkgCIBo0ogg2GIgIaghM/GAECAQEBAQEBAWIohGkBAQEDASMRRQUHBAIBCBEEAQEBAgIjAwICAh8RFAEICAIEAQ0FCIk+AxAIrhSCJYc8DYMqAQEBAQEBAQEBAQEBAQEBAQEBAQEBHYELii+CUYFigxyCXwEEmxg4AY1nhAWCAI56iCSCAIhWAR84gUsVhnR1h2yBDQEBAQ
X-IronPort-AV: E=Sophos;i="5.33,290,1477958400"; d="scan'208";a="200574266"
Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Jan 2017 19:18:10 +0000
Received: from XCH-RCD-005.cisco.com (xch-rcd-005.cisco.com [173.37.102.15]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id v0QJIANi015240 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 26 Jan 2017 19:18:10 GMT
Received: from xch-aln-003.cisco.com (173.36.7.13) by XCH-RCD-005.cisco.com (173.37.102.15) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 26 Jan 2017 13:18:09 -0600
Received: from xch-aln-003.cisco.com ([173.36.7.13]) by XCH-ALN-003.cisco.com ([173.36.7.13]) with mapi id 15.00.1210.000; Thu, 26 Jan 2017 13:18:09 -0600
From: "Bernie Volz (volz)" <volz@cisco.com>
To: "jouni.nospam" <jouni.nospam@gmail.com>, Ted Lemon <mellon@fugue.com>
Subject: RE: [dhcwg] [Int-dir] Review of draft-ietf-dhc-relay-server-security-02
Thread-Topic: [dhcwg] [Int-dir] Review of draft-ietf-dhc-relay-server-security-02
Thread-Index: AQHSd5+8iSisaOl5IUWbOnwv5FiO+aFK8haA///OnZCAALfagIAAAyOAgAAGBgD//5wlwA==
Date: Thu, 26 Jan 2017 19:18:09 +0000
Message-ID: <6ce93be0814a439d96ea9cbdd9f76ecf@XCH-ALN-003.cisco.com>
References: <148541310715.6205.3276873953603821357.idtracker@ietfa.amsl.com> <ff898bc0-81ce-7598-c3f3-2e114d30df30@gmail.com> <e996599692ff4584b8ace30a36ea6881@XCH-ALN-003.cisco.com> <B3CE8C9D-C20C-4FAB-9054-0F09B2B87F63@gmail.com> <C099032E-F538-43AD-970F-F71A1A9E15D8@fugue.com> <367DE531-AF9C-40A3-8B1F-5F595D804023@gmail.com>
In-Reply-To: <367DE531-AF9C-40A3-8B1F-5F595D804023@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.98.1.197]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/LW_tbJh2lDf4EMcj2S4qT8te3vw>
Cc: "ietf@ietf.org" <ietf@ietf.org>, "int-dir@ietf.org" <int-dir@ietf.org>, Tomek Mrugalski <tomasz.mrugalski@gmail.com>, Jouni Korhonen <jounikor@gmail.com>, "dhcwg@ietf.org" <dhcwg@ietf.org>, "draft-ietf-dhc-relay-server-security.all@ietf.org" <draft-ietf-dhc-relay-server-security.all@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Jan 2017 19:18:13 -0000

Hi:

It sounds like we should not use:

"The following text replaces the text in RFC3315 section 21.1 ..."

But instead just use something close to the following which replaces 1st paragraph in section 3:

   For DHCPv6 [RFC3315], this specification REQUIRES IPsec encryption of relay to
   relay and relay to server communication.

   For DHCPv4 [RFC2131], this specification REQUIRES IPsec encryption of relay to
   server communication.

   By using IPsec with encryption for this communication,  the potentially sensitive
   client message and relay included information, such as the DHCPv4 relay-agent
   information option (82), vendor-specific information (for example, [CableLabs-DHCP]),
   and Access-Network-Identifier Option(s) [RFC7839], are protected from pervasive
   monitoring and other attacks.

What is in other documents doesn't really matter ...

- Bernie

-----Original Message-----
From: jouni.nospam [mailto:jouni.nospam@gmail.com] 
Sent: Thursday, January 26, 2017 1:59 PM
To: Ted Lemon <mellon@fugue.com>
Cc: Bernie Volz (volz) <volz@cisco.com>; Tomek Mrugalski <tomasz.mrugalski@gmail.com>; dhcwg@ietf.org; draft-ietf-dhc-relay-server-security.all@ietf.org; ietf@ietf.org; Jouni Korhonen <jounikor@gmail.com>; int-dir@ietf.org
Subject: Re: [dhcwg] [Int-dir] Review of draft-ietf-dhc-relay-server-security-02


> On Jan 26, 2017, at 10:36 AM, Ted Lemon <mellon@fugue.com> wrote:
> 
> On Jan 26, 2017, at 1:25 PM, jouni.nospam <jouni.nospam@gmail.com> wrote:
>> Hmm.. I really do not like specification “games” like this. If you cannot justify a MUST into RFC3315bis, then trying to circumvent the fact in another document (that does not update the RFC3315 or RFC3315bis) should not be a Standards Track document. I could accept this as a BCP or a like.
> 
> Hm, then you are saying that every extension ever done to a protocol that, if it contains MUSTs, MUST update that protocol, even if implementations that support the extension can interoperate with implementations that do not and vice versa.   What’s your basis for this?

No. But in this case there are pieces of text that change specific places in the original document from SHOULDs to MUSTs, musts to MUSTs, and adds few pieces of new stuff, etc. Now how that in not updating? Changes or “extensions” like that would be nice to follow from the base document.

- Jouni

v2.23.0 | Report a Bug | By Email