[multipathtcp] Roman Danyliw's No Objection on draft-ietf-mptcp-rfc6824bis-15: (with COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-mptcp-rfc6824bis-15: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-mptcp-rfc6824bis/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

(1) Section 2.3.  Editorial.  s/successful reception/successful receipt/

(2) Section 5.  Thanks for mentioning the possibility of a downgrade attack in
both the protocol version and algorithm negotiation.  Since [RFC7430] spells
out a clear attacker taxonomy, I’d recommend using it here too (just like it
was used in the new text added for the downgrade attack on the version
negotiation).

Old:
Note that this would be susceptible to bid-down attacks only if the attacker
was on-path (and thus would be able to modify the data anyway).

Proposed New:
Note that this negotiation would be susceptible to a bid-down attack by an
on-path active attacker who could modify the crypto capability bits response
from the receiver to use a less secure crypto mechanism.

(3) Section 6.
> Intrusion Detection Systems look out for traffic patterns and
>     content that could threaten a network.  Multipath will mean that
>     such data is potentially spread, so it is more difficult for an
>      IDS to analyze the whole traffic, and potentially increases the
>      risk of false positives.

I’d recommend being a bit clearer on the impact to NIDS.  Perhaps something
like the following:

Intrusion Detection/Prevention Systems (IDS/IPS) observe packet streams for
patterns and content that could threaten a network.  Multipath may require the
instrumentation of additional paths and correlation of data from these paths to
maintain comparable visibility into all of the traffic between end-points. 
Without such changes, an IDS would get an incomplete view of the traffic where
by increasing the risk of missing traffic of interest and producing false
positive alerts.  MPTCP-aware IDS/IPS would need to read tokens to correlate
multiple subflows and reassemble them for analysis.