Re: [savi] SAVI solution proposal from Jun Bi et al.

Hi All,

This is the latest version of the proposal, which I will present tomorrow:

http://www.ietf.org/internet-drafts/draft-bi-savi-csa-00.txt

Please give us your valuable comments. Thank you!

Best Regards,
Jun bi

----- Original Message ----- 
From: "Fred Baker" <fred@cisco.com>
To: "Christian Vogt" <christian.vogt@nomadiclab.com>
Cc: "Guang Yao" <yaog@netarchlab.tsinghua.edu.cn>; "SAVI Mailing List" 
<savi@ietf.org>
Sent: Friday, July 18, 2008 8:45 PM
Subject: Re: [savi] SAVI solution proposal from Jun Bi et al.

> Gee. Could we get these things posted as internet drafts?
>
> On Jul 18, 2008, at 12:34 PM, Christian Vogt wrote:
>
>> I am forwarding to you a SAVI solution proposal from Jun Bi et
>> al., as well as a first review of this proposal from myself.
>> Reviews and comments from other folks are very welcome, of course.
>>
>> Kind regards,
>> - Christian
>>
>>
>>
>> Begin forwarded message:
>>
>>> From: Christian Vogt <christian.vogt@nomadiclab.com>
>>> Date: July 18, 2008 15:36:08 GMT+03:00
>>> To: Jun Bi <junbi@cernet.edu.cn>, Jianping Wu  <jianping@cernet.edu.cn>,
>>> Guang Yao <yaog@netarchlab.tsinghua.edu.cn>
>>> Cc: Bill Fenner <fenner@fenron.com>, Jari Arkko  <jari.arkko@piuha.net>
>>> Subject: Comments on Your SAVI Proposal
>>>
>>> Jun, Jianping, and Guang,
>>>
>>> thanks for working so quickly on this proposal.  You should  definitely
>>> present it at the SAVI session in Dublin.  I have put you on the 
>>> agenda.
>>>
>>> I must note, though, that the proposal is not fully compliant with  the
>>> SAVI charter in two ways:  (i) It requires host changes, which the
>>> SAVI charter prohibits, and (ii) it performs host authentication,
>>> which also goes beyond the SAVI charter.  This means that there will
>>> likely be skeptical comments at the microphone to which you should be
>>> prepared.  The prospective SAVI solution will have to affect a
>>> compromise between effectiveness (security) and non-intrusiveness (no
>>> false packet drops, backwards compatibility, small configuration
>>> overhead).  Your proposal errs on the side of security in this
>>> trade-off space, Fred's proposal, for one, errs on the side
>>> of non-intrusiveness.  I believe the prospective SAVI solution will
>>> lie between the two.  In any case, it will have to lie within the
>>> charter limits.
>>>
>>> A comment of technical nature:  Your proposal supports different
>>> address configuration methods (autonomous, DHCP, privacy, CGA,
>>> manual).  In one of them, the DHCP case, you require a cryptographic
>>> binding between the initial address generation and the registration  of
>>> this address with the SAVI enforcement point.  You are doing this  even
>>> at the cost of changing the DHCP protocol.  Why is such a binding
>>> required in the DHCP case, and why not in other cases?  Considered
>>> homogenizing this?
>>>
>>> - Christian
>>>
>>>
>>>
>>> On Jul 17, 2008, at 9:06, Jun Bi wrote:
>>>
>>>> Dear Jari and Christian,
>>>>
>>>> This is a draft we want to submit. Please give us some advice.
>>>>
>>>> Best Regards, Jun Bi
>>
>>
>> <csa.txt>_______________________________________________
>> savi mailing list
>> savi@ietf.org
>> https://www.ietf.org/mailman/listinfo/savi
>
> _______________________________________________
> savi mailing list
> savi@ietf.org
> https://www.ietf.org/mailman/listinfo/savi
>
> 