[Ippm-ioam-ix-dt] IPPM IOAM Meeting Summary, February 17th, 2021

[Tal Mizrahi <[e-mail]>]

IPPM IOAM Design Team
Virtual meeting
February 17th, 2021, 07:00 UTC
Webex meeting

Attendees:
Frank Brockners, Barak Gafni, Greg Mirsky, Mickey Spiegel, Tal Mizrahi.

Minutes by Tal Mizrahi.


Summary:
========
- Data, DEX and flag drafts: new version will be posted.
- IETF 110: slots will be requested for the WG drafts and for the
integrity draft.
- The next meeting is on March 3rd, at 07:00 UTC.


Data Draft
==========
- Tal: I created a pull request with a few minor changes to resolve
the Genart review.
- Frank: I did a few minor changes: added a reference to the integrity
draft, and a reference to the deployment draft. Already merged on
Github. We will need some more security details in the deployment
draft.
- Tal: are we ready to post the data draft?
- Frank: yes, I will do that this weekend.


DEX and Flag Drafts
===================
- Tal: I created pull requests for the DEX and flag drafts. Both were
updated regarding security based on an email thread with Martin Duke
on the mailing list. We still have an open issue regarding the hop
count and the length of the DEX header.
- Frank: currently the draft says there is no hop count field.
- Tal: right, that is the case for version 02, which is the current
version of the draft. We have not changed that. Still an open issue.
- Frank: thanks for these updates. It looks like the right update to
the security aspect - we explain it, but do not claim to solve the
problem.


IOAM Integrity Protection Draft
===============================
- Frank: Greg - thanks for your comments regarding the integrity
draft. Shwetha is currently working on some more text that suggests to
use the IPsec Authentication Header (AH).
- Barak: why do we stop at integrity protection, and not encryption?
- Tal: I believe integrity protection is an important requirement for
IOAM protocols, while confidentiality is typically not considered
crucial for IOAM.
- Frank: this is basically the comment we received from the security
experts, and we wrote the draft based on these comments.
- Tal: recon is usually a less severe threat than DoS, and that is why
integrity of OAM is more important than encryption.
- Barak: but we heard concerns from the IPv6 community that IOAM data may leak.
- Frank: leaking is a concern, but it is not strictly a
confidentiality issue. Leaking may result from implementation
problems.


Upcoming IETF Meeting
=====================
- Tal: the IETF meeting is coming up. I will request a slot for the
DEX and flag drafts.
- Frank: all the working group drafts need to be discussed. The YANG
module should also be presented - hopefully Tianran can present it.


Hybrid two-step and IOAM
========================
- Frank: regarding the hybrid two-step, it would help if we could have
an example or two regarding encapsulations and how to match a packet
to its follow-up packet.
- Greg: right, I will appreciate some discussion on the mailing list.
- Mickey: there are a few possible ways to link a packet to its
follow-up packet. Have you considered it?
- Greg: there may be one document that covers encapsulations, or there
may be a few documents.
- Mickey: do you think of adding fields to these encapsulations?
- Greg: there is a shim header that includes some metadata.
- Mickey: is there a chance you do not match a packet with its follow-up packet?
- Greg: the trigger packet is an OAM packet with a header that defines
the profile of OAM data to be collected.
- Frank: maybe you can have a hybrid two-step option type that
includes a way of associating the trigger packet with the follow-up?
- Greg: let's start this discussion on the mailing list. It will help.