Re: [ippm] Adoption call for IOAM deployment and integrity documents

["Frank Brockners (fbrockne)" <[e-mail]>]

Hi Al,

Thanks a lot for your review and support. Please see inline.

From: ippm <[e-mail]> On Behalf Of MORTON JR., AL
Sent: Montag, 16. August 2021 02:19
To: Tommy Pauly <tpauly=[e-mail]>; IETF IPPM WG ([e-mail]) <[e-mail]>
Subject: Re: [ippm] Adoption call for IOAM deployment and integrity documents

Hi Tommy, Authors, and IPPM,

I took a look at one of the drafts the WG is considering:

For Integrity of In-situ OAM Data Fields, I got tripped-up by the first sentence of the Abstract 😊,

   In-situ Operations, Administration, and Maintenance (IOAM) records
   operational and telemetry information in the packet while the packet
   traverses a path between two points in the network.

I read “records” as a noun, not as a verb as I now see was intended. maybe s/records/collects/ to resolve that ambiguity.

…FB: That is a good suggestion. We’ll use “collect” instead of “record” moving forward.

Then the second sentence:

   ...  IOAM deployments
   could require ensuring the integrity of IOAM data fields.

Maybe we can say more specifically what needs to be done, something like:

IETF protocols require features to ensure their security; this document describes integrity protect for IOAM data fields.
…FB: Another good suggestion. Similar to what you note below, the heritage of the above sentence is that the document started as an informational document discussing options for integrity protection.


In the Intro, after saying:
   As such, IOAM tracing data is carried in
   the packets in clear and there are no protections against any node or
   middlebox tampering with the data.

the draft says:
...  As a consequence, IOAM tracing
   data collected in an untrusted or semi-trusted environments cannot be
   trusted for critical operational decisions.

I think this is where the draft should indicate that a form of integrity protection is the solution to the problem, such as:

...IOAM tracing data collected in an untrusted or semi-trusted environments
   requires integrity protection to support critical operational decisions.

Parts of the intro need to move beyond the “this is for IPPM WG study” phase, to the “here’s the integrity protection solution(s)” voice.

…FB: Good points. We’ll fix those in the next rev – and ensure that the doc uses the appropriate language for a standards track document.

Otherwise, the threat analysis is useful, and the Methods of providing integrity to IOAM data fields seem clear.

I support the adoption of “Integrity of In-situ OAM Data Fields” for additional development by the WG.

Thanks again Al.

Cheers, Frank

Al


From: ippm <[e-mail]<mailto:[e-mail]>> On Behalf Of Tommy Pauly
Sent: Tuesday, August 3, 2021 12:29 PM
To: IETF IPPM WG ([e-mail]<mailto:[e-mail]>) <[e-mail]<mailto:[e-mail]>>
Subject: [ippm] Adoption call for IOAM deployment and integrity documents

Hello IPPM,

As discussed in our meeting last week, we will be starting an adoption call for two IOAM-related documents that have been raised as important dependencies during the IESG review of IOAM-data.

This email begins a Working Group adoption call for two documents:

Integrity of In-situ OAM Data Fields
https://datatracker.ietf.org/doc/draft-brockners-ippm-ioam-data-integrity/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-brockners-ippm-ioam-data-integrity/__;!!BhdT!0Ny1D5V4maIuQ6qGnzMqhb2g1XeWhqAWW3MMMWLT5TI-730YRx2JHVbaSFNx$>
https://www.ietf.org/archive/id/draft-brockners-ippm-ioam-data-integrity-03.html<https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-brockners-ippm-ioam-data-integrity-03.html__;!!BhdT!0Ny1D5V4maIuQ6qGnzMqhb2g1XeWhqAWW3MMMWLT5TI-730YRx2JHQVTAIy3$>

In-situ OAM Deployment
https://datatracker.ietf.org/doc/draft-brockners-opsawg-ioam-deployment/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-brockners-opsawg-ioam-deployment/__;!!BhdT!0Ny1D5V4maIuQ6qGnzMqhb2g1XeWhqAWW3MMMWLT5TI-730YRx2JHUSOBrbQ$>
https://datatracker.ietf.org/doc/html/draft-brockners-opsawg-ioam-deployment-03<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-brockners-opsawg-ioam-deployment-03__;!!BhdT!0Ny1D5V4maIuQ6qGnzMqhb2g1XeWhqAWW3MMMWLT5TI-730YRx2JHWwp9dBH$>

This call will last until Wednesday, August 18. Please reply to this email with your comments, and if you think these documents should be taken on by IPPM.

Best,
Tommy & Ian