Re: [lmap] Kathleen Moriarty's No Objection on draft-ietf-lmap-framework-12: (with COMMENT)

"MORTON, ALFRED C (AL)" <acmorton@att.com> Sun, 12 April 2015 21:49 UTC

From: "MORTON, ALFRED C (AL)" <acmorton@att.com>
To: Kathleen Moriarty <Kathleen.Moriarty.ietf@gmail.com>, The IESG <iesg@ietf.org>
Date: Sun, 12 Apr 2015 17:49:35 -0400
Thread-Topic: [lmap] Kathleen Moriarty's No Objection on draft-ietf-lmap-framework-12: (with COMMENT)
Thread-Index: AdBya2tNqN4IBzpAQN20hquvpjkiMwC++Qcg
Message-ID: <4AF73AA205019A4C8A1DDD32C034631D01608849F4@NJFPSRVEXG0.research.att.com>
References: <20150409021752.2465.57916.idtracker@ietfa.amsl.com>
In-Reply-To: <20150409021752.2465.57916.idtracker@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/lmap/GAQgDJm6YDC2vFz8M8FAr5EedsU>
Cc: "dromasca@avaya.com" <dromasca@avaya.com>, "lmap-chairs@ietf.org" <lmap-chairs@ietf.org>, "lmap@ietf.org" <lmap@ietf.org>
Subject: Re: [lmap] Kathleen Moriarty's No Objection on draft-ietf-lmap-framework-12: (with COMMENT)
Precedence: list

Hi Kathleen,

> -----Original Message-----
> From: lmap [mailto:lmap-bounces@ietf.org] On Behalf Of Kathleen Moriarty
...
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thank you for your very careful and detailed attention to security and
> privacy, with options suggested to protect privacy in practice through
> group ids instead of ones that identify an individual.
> 
> I just have one question. The security considerations section has a
> lower case 'must' for providing session encryption, but then the privacy
> section warns that monitoring can be possible when sessions are not
> encrypted.  

lc must is as demanding as we get in this memo, there are no 2119 terms as agreed.

You may be referring to this sentence at the end of the privacy section, 8.4.4
and the figure in that section:

	If the Measurement Traffic is unencrypted, as found in many systems today, 
	then both timing and limited results are open to on-path observers.

The measurement traffic is distinctly different from the 
LMAP Control and Reporting protocols. We have ability/scope to
specify requirements on the LMAP Control and Reporting protocols,
and have required encryption.

The measurement traffic itself is out of scope for LMAP.
It may be unencrypted user traffic which we observe passively,
or it may be an un-encrypted (active) stream dedicated to measurement
(which is in the clear to avoid encryption processing with its
impact on performance - the objective is to assess the network).
But even this active measurement traffic would likely be encrypted when
e2e encryption becomes the norm.

> When I saw the privacy considerations, I went back to the
> security section to make sure active attacks against session traffic
> that was not encrypted was addressed as I didn't see this same 'must'
> and by that time needed to go back to make sure something as in place.
> I'm wondering why these weren't just addressed together since more
> security things could happen too if sessions were not encrypted (in
> other words, there could be less text, unless I am missing something and
> we need more on the security side).  Thanks!
> 
Attacks on measurement traffic and their supporting protocols are
covered in the relevant WG literature (e.g., IPPM and IPFIX).

hope this helps,
Al

[lmap] Kathleen Moriarty's No Objection on draft-… Kathleen Moriarty
Re: [lmap] Kathleen Moriarty's No Objection on dr… MORTON, ALFRED C (AL)