[ppsp] [Errata Verified] RFC7574 (4725)

RFC Errata System <rfc-editor@rfc-editor.org> Mon, 21 August 2017 13:57 UTC

To: shkim@etri.re.kr, arno@cs.vu.nl, r.petrocco@gmail.com, victor.grishchenko@gmail.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: spencerdawkins.ietf@gmail.com, iesg@ietf.org, ppsp@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20170821135653.5452FB81120@rfc-editor.org>
Date: Mon, 21 Aug 2017 06:56:53 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/ppsp/l8us_ll5jCy11M0rjGUmGgnciQo>
Subject: [ppsp] [Errata Verified] RFC7574 (4725)
Precedence: list

The following errata report has been verified for RFC7574,
"Peer-to-Peer Streaming Peer Protocol (PPSPP)".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid4725

--------------------------------------
Status: Verified
Type: Technical

Reported by: Sung Hei Kim, Chang Kyu Lee <shkim@etri.re.kr>
Date Reported: 2016-07-01
Verified by: Spencer Dawkins (IESG)

Section: 5

Original Text
-------------
PPSPP can use different methods for protecting the integrity of the
content while it is being distributed via the peer-to-peer network.
More specifically, PPSPP can use different methods for receiving
peers to detect whether a requested chunk has been maliciously
modified by the sending peer. In benign environments, content
integrity protection can be disabled.

For static content, PPSPP currently defines one method for protecting
integrity, called the Merkle Hash Tree scheme. If PPSPP operates
over the Internet, this scheme MUST be used. If PPSPP operates in a
benign environment, this scheme MAY be used. So the scheme is
mandatory to implement, to satisfy the requirement of strong security
for an IETF protocol [RFC3365]. An extended version of the scheme is
used to efficiently protect dynamically generated content (live
streams), as explained below and in Section 6.1.

Corrected Text
--------------
PPSPP can use different methods for protecting the integrity of the
content while it is being distributed via the peer-to-peer network.
More specifically, PPSPP can use different methods for receiving
peers to detect whether a requested chunk has been maliciously
modified by the sending peer.

For static content, PPSPP currently defines one method for protecting
integrity, called the Merkle Hash Tree scheme.
The scheme is mandatory to implement, to satisfy the requirement of
strong security for an IETF protocol [RFC3365]. An extended version
of the scheme is used to efficiently protect dynamically generated
content (live streams), as explained below and in Section 6.1.

Notes
-----
RFC 7574 (PPSP-PP) defines how the peers exchange chunks regarding content integrity protection scheme. It describes the relationship of the DATA and INTEGRITY messages.
But, it does not describes how peers exchange chunks when the content integrity protection scheme is disabled.
Thus, to the readers, it seems that content integrity protection scheme is very important part of PPSP-PP and must be used in order to implement PPSP-PP.
I think the RFC 7574 (PPSP-PP) should be changed to clearly express that the content integrity protection scheme must be used in PPSP-PP.
The proposed changes is to remove options regarding the use of content integrity protection.

Spencer: confirmed in conversations with Victor Grishchenko <victor.grishchenko@gmail.com> on the PPSP mailing list.

--------------------------------------
RFC7574 (draft-ietf-ppsp-peer-protocol-12)
--------------------------------------
Title : Peer-to-Peer Streaming Peer Protocol (PPSPP)
Publication Date : July 2015
Author(s) : A. Bakker, R. Petrocco, V. Grishchenko
Category : PROPOSED STANDARD
Source : Peer to Peer Streaming Protocol
Area : Transport
Stream : IETF
Verifying Party : IESG

[ppsp] [Errata Verified] RFC7574 (4725) RFC Errata System