Re: [secdir] secdir review of draft-ietf-tsvwg-port-use

"Dan Harkins" <dharkins@lounge.org> Tue, 03 February 2015 00:18 UTC

Message-ID: <e6edc7afad0f732379c27b412b08220c.squirrel@www.trepanning.net>
In-Reply-To: <54CFC20E.9000701@isi.edu>
References: <950ad656ed2a0e36e24fd7dc0e2b60b1.squirrel@www.trepanning.net> <54CFC20E.9000701@isi.edu>
Date: Mon, 02 Feb 2015 16:17:52 -0800
From: Dan Harkins <dharkins@lounge.org>
To: Joe Touch <touch@isi.edu>
User-Agent: SquirrelMail/1.4.14 [SVN]
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Importance: Normal
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/6N_vgs4_V5eposSiD4q45i1F_z4>
Cc: draft-ietf-tsvwg-port-use.all@tools.ietf.org, iesg@ietf.org, secdir@ietf.org
Subject: Re: [secdir] secdir review of draft-ietf-tsvwg-port-use
Precedence: list

  Hi Joe,

On Mon, February 2, 2015 10:29 am, Joe Touch wrote:
> Hi, Dan,
>
> It should be easy to add DTLS where TLS is cited. IPsec is an
> interesting issue; I can add a few sentences to the security
> considerations area about that - e.g., that IPsec protects in a
> different way than TLS/DTLS, and that one key aspect of its
> configuration is port-specific parameters, which means it may be
> difficult to use separate IPsec policies on different services unless
> their port numbers are known and fixed in advance (even if using dynamic
> port numbers).

  There's also the issue that even if it uses fixed ports the app has
no assurance that IPsec will even be protecting it. From the app's
perspective it's basically write-and-pray.

> That latter is probably 2-3 short sentences, and I think would be
> worthwhile.

  That would be great and would address my comment.

  regards,

  Dan.

> Joe
>
> On 1/30/2015 4:04 PM, Dan Harkins wrote:
>>
>>    Hello,
>>
>>    I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>>    This draft provides some advice and recommendations on protocol
>> port use to application and service designers. It has a nice, brief
>> history of port usage and a nice list of guiding principles to help
>> conserve port space. It will make a nice BCP. In my opinion it is Ready
>> For Publication. With that said, I do have a small comment. In section
>> 7.4 the draft says that TLS should be used to protect services that do
>> not provide their own security directly. It might be worth while adding
>> mention of DTLS and IPsec. And if the latter is not something that
>> should be recommended then justification for that stance should be
>> given.
>>
>>    regards,
>>
>>    Dan.
>>
>

[secdir] secdir review of draft-ietf-tsvwg-port-u… Dan Harkins
Re: [secdir] secdir review of draft-ietf-tsvwg-po… Joe Touch
Re: [secdir] secdir review of draft-ietf-tsvwg-po… Dan Harkins
Re: [secdir] secdir review of draft-ietf-tsvwg-po… Joe Touch