RE: [NSIS] AD Review comments on draft-ietf-nsis-req-07.txt

Hi Allison,

I do not completely understand your argument for MUST implementation of hop-by-hop security. 'Must be implemented but not must use' means that there is the possibility to use hop-by-hop security in any NE but it has to be implemented even if it is never used. 'SHOULD be supported' means that it has to be implemented except in particular cases. I think it is strong enough. 

Best regards, Attila

> 
> 5.7.5 Hop-by-hop security 
>     
>    Hop-by-Hop security SHOULD be supported. It is a well known and 
>    proven concept in Quality-of-Service and other signaling protocols 
>    that allows intermediate nodes that actively participate in the 
>    protocol to modify the messages as it is required by processing 
>    rules. Note that this requirement does not exclude end-to-end or 
>    network-to-network security of a signaling message. End-to-end 
>    security between the initiator and the responder may be used to 
>    provide protection of non-mutable data fields. Network-to-network 
>    security refers to the protection of messages over various 
> hops but 
>    not in an end-to-end manner i.e. protected over a 
> particular network. 
> 
> Without minimum mandatory to implement channel security for 
> the signaling, 
> you can't be sure the other security features will be 
> untampered with -
> this needs to be a MUST implement (it's not a MUST use).  
> Suggest changing
> the first sentence to "Channel security between signaling entities
> MUST be implemented'?
> 
_______________________________________________
nsis mailing list
nsis@ietf.org
https://www1.ietf.org/mailman/listinfo/nsis