[Ippm-ioam-ix-dt] IOAM Meeting Minutes

[Ippm-ioam-ix-dt] IOAM Meeting Minutes - February 3rd, 2021

Tal Mizrahi <tal.mizrahi.phd@gmail.com> Wed, 03 February 2021 07:53 UTC

MIME-Version: 1.0
From: Tal Mizrahi <tal.mizrahi.phd@gmail.com>
Date: Wed, 03 Feb 2021 09:52:56 +0200
Message-ID: <CABUE3XkK1kBu9V4mqBr6Q_W3V+70e-TpFvQB+6kiy7iZwTtkiQ@mail.gmail.com>
To: ippm-ioam-ix-dt@ietf.org
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ippm-ioam-ix-dt/81Vb4cVJKc7AO_IWYfHxywB_Ouk>
Subject: [Ippm-ioam-ix-dt] IOAM Meeting Minutes - February 3rd, 2021
Precedence: list

IPPM IOAM Design Team
Virtual meeting
February 3rd, 2021, 07:00 UTC
Webex meeting

Attendees:
Frank Brockners, Greg Mirsky, Tal Mizrahi.

Minutes by Tal Mizrahi.


Summary:
========
- Integrity protection draft: first draft was submitted, and some more
discussion will happen on the mailing list.
- Tal and Frank will submit pull requests with updates to the data draft.
- Further thought will be given to the hybrid two step draft and its
connection to DEX.
- The next meeting will be on February 17th at 07:00 UTC.


IOAM Integrity Protection Draft
===============================
- Tal: there is a new integrity protection draft. We hope at this
point we can proceed with publishing the IOAM data draft.
- Greg: I read the new draft, and it looks good. Is it limited to
trace options? I believe it should refer to other options and to
direct exporting. It would be good if there was a single security
solution for the hybrid two-step approach and for direct exporting.
For trace options there is overhead for implementing security. The
challenge for the trace option is operating at line rate. Direct
exporting and hybrid two step can help.
- Frank: there is a specific text in the draft that says that the
scope is not limited to trace options. We can apply the same approach
to end-to-end options or to DEX. We can use another example of a fixed
header such as DEX. The methods described apply to all options. We can
add another section to the draft: options that do not change along the
path, which make it simpler.
- Greg: the introduction section does not have a reference to the DEX
draft. There is  only discussion about tracing. I agree that the
methods described in the draft can be applied to other variants such
as DEX.
- Frank: sure, I can add some text that refers to DEX. Are you saying
that it may be simpler if there are fixed length headers?
- Greg: it may be easier to apply at line rate.
- Frank: I can see your point. We can add some text about potentially
using a fixed header.
- Greg: in DEX over IPv6 the integrity can be in IPv6 extension headers.
- Tal: do you mean IPsec Authentication Header (AH)?
- Greg: yes.
- Frank: that would require an IPsec tunnel between endpoints. Does
IPsec AH protect other extension headers?
- Greg: I believe it does.
- Frank: that sounds like a low hanging fruit for some scenarios. It
is worth a closer look.
- Greg: it would be worthwhile to ask the IPPM chairs to get people
from the security area involved in this.
- Frank: right, we have sent the draft to the security people that
triggered writing this draft, but we have not received feedback yet.


Draft submissions before IETF 110
=================================
- Tal: there is a submission deadline for IETF 110 on February 22nd.
We want to update the drafts by then. There are a couple of updates I
promised to do. I will create a pull request.
- Frank: right, will also submit a pull request with my changes as well.
- Tal: I will also update the flag and DEX drafts. There is still the
major open issue in the DEX draft. I will revisit the issue on the
mailing list.


Hybrid Two Step (HTS) IOAM
==========================
- Greg: the hybrid two-step approach uses follow up messages for
sending the telemetry information. The advantage is that you do not
need to increase the length of data packets - the data plane is
unchanged. Another advantage is that follow up messages can be sent in
lower priority. Low latency reliable applications - the resources are
expensive. Disconnect generating information from collecting.
- Tal: does follow up have to share the same path as the data it monitors?
- Greg: yes.
- Tal: in some cases different QoS will be forwarded through a different path.
- Greg: but it does not have to be the case. You want to make sure
that follow up goes though the same path.
- Frank: does integrity protection happen on each hop?
- Greg: yes, but the performance requirement is less strict since it
does not operate in line rate.
- Frank: sounds interesting. I will read it.
- Greg: it would be helpful to get some more discussion on the mailing list.

[Ippm-ioam-ix-dt] IOAM Meeting Minutes - February… Tal Mizrahi