Re: [mpls] MPLS-RT review of draft-farrelll-mpls-opportunistic-encrypt-04.txt

["Lizhong Jin" <[e-mail]>]

Hi all,
I reviewed draft-farrelll-mpls-opportunistic-encrypt-04 as the member of MPLS Review Team.
I am not an security expert, so I review the draft from the MPLS feasibility point of view,
and think the document is useful and technically sound. I have several questions, and would 
appreciate to resolve them before WG adoption.

Section 2.1, the scale of configuration that is needed for a full set of SAs between all 
communicating parties
[Lizhong] need to expand acronym "SA", security association?

Section 3, Everything that follows the control word is the entire original MPLS packet encrypted.
[Lizhong] also for Figure1, in the PHP case, the original MPLS packet will not have label, then if the 
packet is also encrypted and encapsulated after control work, then how to parse the packet 
correctly? The control word will not tell the following payload is MPLS or IP.

Section 3, The payload is the data carried by the MPLS packet (such as IP) and may be prefixed 
by a control word.
[Lizhong] if the control word is optional, then do we need any negotiation mechanism to enable
control word or not?

When decryption at the egress LER, the TTL&TC processing of the first decrypted label should be
A bit different with previous mechanism. The TTL&TC value may need to inherit from the label before
MEL in uniform mode.

Regards
Lizhong


> -----Original Message-----
> From: Loa Andersson [mailto:[e-mail]]
> Sent: 2015年5月4日 2:40
> To: David Allan I; Mach Chen; Lizhong Jin; Kamran Raza (skraza)
> Cc: [e-mail];
> [e-mail]
> Subject: MPLS-RT review of draft-farrelll-mpls-opportunistic-encrypt-04.txt
> 
> Dave, Mach, Lizhong and Kamran,
> 
> 
> You have be selected as MPLS-RT reviewers for
> draft-farrelll-mpls-opportunistic-encrypt.
> 
> Note to authors: You have been CC'd on this email so that you can know that
> this review is going on. However, please do not review your own document.
> 
> Note to the reviewers: I understand that this document is very much on the
> "security side of the house", however I will also reach out to the Sec-Dir for a
> more security biased review.
> This should not stop you from commenting on security aspects of the draft, but
> if you feel like it I'm comfortable with a "normal MPLS-RT review", responding
> to questions below.
> 
> Reviews should comment on whether the document is coherent, is it useful (ie,
> is it likely to be actually useful in operational networks), and is the document
> technically sound?  We are interested in knowing whether the document is
> ready to be considered for WG adoption (ie, it doesn't have to be perfect at this
> point, but should be a good start).
> 
> Reviews should be sent to the document authors, WG co-chairs and WG
> secretary, and CC'd to the MPLS WG email list. If necessary, comments may be
> sent privately to only the WG chairs.
> 
> If you have technical comments you should try to be explicit about what
> *really* need to be resolved before adopting it as a working group document,
> and what can wait until the document is a working group document and the
> working group has the revision control.
> 
> Are you able to review this draft by May 17, 2015? Please respond in a timely
> fashion.
> 
> 
> Thanks, Loa
> (as MPLS WG chair)
> 
> 
> --
> 
> 
> Loa Andersson                        email: [e-mail]
> Senior MPLS Expert                          [e-mail]
> Huawei Technologies (consultant)     phone: [phone]