Re: [ippm] Benjamin Kaduk's Discuss on draft-ietf-ippm-stamp-option-tlv-07: (with DISCUSS and COMMENT)

[Benjamin Kaduk <[e-mail]>]

Hi Greg,

Thanks for the updates;

On Wed, Jul 22, 2020 at 03:24:54PM -0700, Greg Mirsky wrote:
> 
> PS. I've clipped the COMMENTS as these now have the discussion thread
> of their own.
> 
> On Thu, Jul 16, 2020 at 7:48 PM Benjamin Kaduk <[e-mail]> wrote:
> >
> > On Thu, Jul 16, 2020 at 05:38:08PM -0700, Greg Mirsky wrote:
[...]
> GIM2>> I have some reservations to say that a particular TLV MUST be
> accompanied by the HMAC TLV. If a domain secured, an operator may use
> a TLV, e.g., CoS TLV, without authentication. I think that the current
> text:
>    The HMAC TLV MAY be used to protect the integrity of STAMP extensions
>    in STAMP unauthenticated mode.
> can be expanded to require that an implementation can enable
> authentication of extensions via the management plane. It might be as:
> NEW TEXT:
>    The HMAC TLV MAY be used to protect the integrity of STAMP extensions
>    in STAMP unauthenticated mode.  An implementation of STAMP extensions
>    MUST provide controls to enable the integrity protection of STAMP
>    extensions in STAMP unauthenticated mode.
> Would the updated text be acceptable?

In light of the long delay (entirely my fault) in responding, I've prepared
a new ballot position to cover this topic and the other notes I made from
my re-review.  But in short: I can accept the weaker form of mandatory
behavior that you propose here, but we should still clearly document the
considerations that come into play for unauthenticated operation.

Thanks, and sorry again for the slow response,

Ben

> 
> >
> > I think the idea was to require the HMAC TLV to accompany those TLVs that
> > represent "control information", yes.  My initial read of the document
> > (reflected in my longer comments) says that the Location and Timestamp
> > Information TLVs would be considered to contain such "control information",
> > though on reread perhaps the Timestamp Information is not always considered
> > sensitive.  I'm on the fence about Location, and I think that Class of
> > Service is pretty clearly on the "control information" side of things
> > (since it affects the headers of the containing IP packet and consequently
> > the behavior of the network).
> 
> GIM2>> I agree that CoS is very close to what we consider "control
> information" as it includes information that affects how the reflected
> test packet is transmitted. But as in RFC 8762 itself, HMAC TLV is
> defined as optional in STAMP unauthenticated mode and, as I think of
> it, that leaves the choice to an operator whether to protect the
> integrity of the CoS TLV or not. Do you think that such arrangement is
> acceptable?