Re: [manet] Ben Campbell's No Objection on draft-ietf-manet-dlep-26: (with COMMENT)

["Ben Campbell" <[e-mail]>]

On 15 Dec 2016, at 8:58, Rick Taylor wrote:

> On Thu, 2016-12-15 at 08:53 -0600, Ben Campbell wrote:
>> On 15 Dec 2016, at 2:45, Henning Rogge wrote:
>>
>>>
>>> On Wed, Dec 14, 2016 at 5:31 PM, Ben Campbell <[e-mail]>
>>> wrote:
>>>>
>>>>>
>>>>> We (the co-authors) have received feedback from some radio
>>>>> vendors 
>>>>> stating
>>>>> that a "MUST use TLS" in all cases would be a show-stopper. We
>>>>> see
>>>>> deployments where a small number of devices co-exist on the
>>>>> LAN 
>>>>> segment -
>>>>> for example, a router, a line-of-sight radio, a satellite
>>>>> terminal, 
>>>>> and a
>>>>> small number of other devices. We're open to the construction
>>>>> you 
>>>>> suggest,
>>>>> and will discuss it.
>>>> Understood. That suggests there are reasons to not _use_ TLS
>>>> other 
>>>> than the
>>>> listed one, so "MUST unless" may not be what you want.  Any
>>>> thoughts 
>>>> on why
>>>> TLS should not be mandatory to _implement_?
>>> I might exaggerate it a little bit but I think using TLS for DLEP
>>> is
>>> at best a waste of time to implement. I have yet to hear about an
>>> attacker model for a single hop DLEP connection (which is necessary
>>> because otherwise the bridged datapath is broken!) which is not
>>> easily
>>> dealt with MAC-layer security.
>>>
>>> At worst TLS will kill one of the most important aspects of DLEP,
>>> easy
>>> integration and autodiscovery of radios by different vendors to any
>>> kind of router.
>>>
>>> TLS also opens  can of worms (additional questions). How is the
>>> DLEP
>>> certificates be handled? Are there mandatory types of certificate
>>> algorithms (if not, you break interoperability)? How do you secure
>>> the
>>> UDP part of DLEP for discovery (DTLS?) ? How do you make sure that
>>> the
>>> DTLS connection is to the same endpoint as the TLS connection?
>>>
>>> There is a LOT of work in this direction without any gain.
>> IIRC, you are arguing against even the existing "SHOULD implement" 
>> requirement?
>>
>> When you talk about a single-hop connection, are you assuming a
>> direct 
>> connection from the router to the modem, or that the router and
>> modem 
>> are on the same LAN segment?
>
> Most of the discussed use-cases where TLS is viewed as unnecessary are
> direct connections, but some are single-hop with an 'externally 
> secured
> perimeter'.
>
> The authors are happy with 'SHOULD' if it removes any blocks from the
> IESG, and the WG consensus is that 'MUST' will not work for
> implementers.

Am I hearing that this is one of those proverbial "SHOULD BUT WE KNOW 
YOU WON'T" requirements :-)

>
> Rick