Re: [savi] AD review of draft-ietf-savi-fcfs

Hi,

2011/10/14 Alberto García <alberto@it.uc3m.es>:
> Hi
>
> |  -----Mensaje original-----
> |  De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre de
> |  Jean-Michel Combes
> |  Enviado el: jueves, 13 de octubre de 2011 17:57
> |  Para: marcelo bagnulo braun
> |  CC: draft-ietf-savi-fcfs@tools.ietf.org; SAVI Mailing List
> |  Asunto: Re: [savi] AD review of draft-ietf-savi-fcfs
> |
> |  Sorry, in fact, proxy SEND checks validity of SENDized ND exchanges
> (draft-
> |  ietf-csi-proxy-send-05, section 5.2.1, 1.B). So, proxy SEND could be used
> but:
> |  - proxy SEND requires hosts, in the network, are compliant with proxy
> SEND
>
> Yes. We should assume the following scenario (scenario #1): a link in which
> all receivers are capable of processing proxy SEND messages (aka 'SPND
> nodes'), and nodes either generate SEND or Proxy SEND messages.

Agree.

>
> |  - proxy SEND is not "transparent" and so SAVI device will lose its
> |  "invisibility" feature
>
> I don't understand this.

With proxy SEND, the nodes know there is a proxy SEND entity (based on
the Proxy Signature Option), that could act as SAVI device too (i.e.,
an useful information for a potential attacker).
With SEND SAVI, IIRC, the SAVI device is not visible for the nodes on
the link (as the SAVI device uses SENDized NUD messages, it looks like
to a common SEND node).

> Maybe you are thinking about a different deployment scenario to the one I
> commented above, an alternative way of 'mixing' SAVI and proxy SEND, in
> which SAVI devices would act as Proxy SEND devices for non-SEND nodes
> (scenario #2).

no no, cf. above :)

> I think this is a bad idea, because it provides without reason the same
> confidence to SEND and non-SEND devices, and I'm sure that this is not what
> we want to do. In the examples shown in the Proxy SEND draft, there is a
> strong security link between the Proxy SEND device and the proxied nodes.
>
>
> |  - proxy SEND requires many actions (certificate management, IP packet
> |  modification, etc) and I am not sure that SAVI device will be able to do
> this
> |  as in common use cases the SAVI device is a L2 device.
> In scenario #1, SAVI devices only validate Proxy SEND messages. They only
> need to have the same capabilities of SPND nodes. So this features you
> comment are not needed.
> I think adding proxy SEND validation to SEND SAVI would be quite simple, and
> without much trouble.

I think you (or is it me? :)) missed the point from Jari: from what I
understood, Jari's question is "Is it possible to use proxy SEND
(combined with FCFS SAVI) instead of SEND SAVI?".
Jari, confirmation?

Best regards,

JMC.

>
> Makes sense?
> If the answer is 'yes', then
> - I could add some comment on Proxy SEND in the SEND SAVI document
> - A line in the fcfs-savi document such as the current 'So, when SEND is
> deployed, it is recommended to use SEND SAVI' (or could be also this
> alternative text 'So, when SEND or Proxy SEND is deployed, it is recommended
> to use SEND SAVI') sounds ok to me.
>
> Regards,
> Alberto
>
> |  - proxy SEND would need an API with FCFS SAVI
> |
> |  Best regards.
> |
> |  JMC.
> |
> |  2011/10/13 Jean-Michel Combes <jeanmichel.combes@gmail.com>:
> |  > Hi,
> |  >
> |  > 2011/10/13 marcelo bagnulo braun <marcelo@it.uc3m.es>:
> |  >> Hi Jari,
> |  >>
> |  >> Please find the replies below marked with MB>
> |  >>
> |  >>
> |  >> El 04/05/11 20:41, Jari Arkko escribió:
> |  >>>
> |  >
> |  > [snip]
> |  >
> |  >>
> |  >>>> So, when SEND is deployed, it is recommended to use SEND SAVI
> |  >>>> [I-D.ietf-savi-send
> |  >>>> <http://tools.ietf.org/html/draft-ietf-savi-fcfs-09#ref-I-D.ietf-sa
> |  >>>> vi-send>]
> |  >>>> rather than FCFS SAVI."
> |  >>>
> |  >>> Is there some reason why proxy SEND cannot be employed here?
> |  >>>
> |  >>
> |  >> MB> I will let Alberto to reply this one.
> |  >
> |  > This text comes from my review as shepherd of this document.
> |  >
> |  > As proxy SEND doesn't permit to check the validity of SENDized ND
> |  > exchanges, IMHO, proxy SEND cannot be used easily.
> |  >
> |  > Best regards.
> |  >
> |  > JMC.
> |  >
> |  >>
> |  >> Regards, marcelo
> |  >>
> |  >>
> |  >>> Jari
> |  >>>
> |  >>>
> |  >>
> |  >>
> |  >> _______________________________________________
> |  >> savi mailing list
> |  >> savi@ietf.org
> |  >> https://www.ietf.org/mailman/listinfo/savi
> |  >>
> |  >
> |  _______________________________________________
> |  savi mailing list
> |  savi@ietf.org
> |  https://www.ietf.org/mailman/listinfo/savi
>
>