Re: [secdir] secdir review of draft-ietf-tsvwg-port-use

[Joe Touch <[e-mail]>]

On 2/2/2015 4:17 PM, Dan Harkins wrote:
> 
>   Hi Joe,
> 
> On Mon, February 2, 2015 10:29 am, Joe Touch wrote:
>> Hi, Dan,
>>
>> It should be easy to add DTLS where TLS is cited. IPsec is an
>> interesting issue; I can add a few sentences to the security
>> considerations area about that - e.g., that IPsec protects in a
>> different way than TLS/DTLS, and that one key aspect of its
>> configuration is port-specific parameters, which means it may be
>> difficult to use separate IPsec policies on different services unless
>> their port numbers are known and fixed in advance (even if using dynamic
>> port numbers).
> 
>   There's also the issue that even if it uses fixed ports the app has
> no assurance that IPsec will even be protecting it. From the app's
> perspective it's basically write-and-pray.

Yes, thanks for pointing that out. I'll add that too.

> 
>> That latter is probably 2-3 short sentences, and I think would be
>> worthwhile.
> 
>   That would be great and would address my comment.

AOK - thanks again!

Joe

> 
>   regards,
> 
>   Dan.
> 
>> Joe
>>
>> On 1/30/2015 4:04 PM, Dan Harkins wrote:
>>>
>>>    Hello,
>>>
>>>    I have reviewed this document as part of the security directorate's
>>> ongoing effort to review all IETF documents being processed by the
>>> IESG.  These comments were written primarily for the benefit of the
>>> security area directors.  Document editors and WG chairs should treat
>>> these comments just like any other last call comments.
>>>
>>>    This draft provides some advice and recommendations on protocol
>>> port use to application and service designers. It has a nice, brief
>>> history of port usage and a nice list of guiding principles to help
>>> conserve port space. It will make a nice BCP. In my opinion it is Ready
>>> For Publication. With that said, I do have a small comment. In section
>>> 7.4 the draft says that TLS should be used to protect services that do
>>> not provide their own security directly. It might be worth while adding
>>> mention of DTLS and IPsec. And if the latter is not something that
>>> should be recommended then justification for that stance should be
>>> given.
>>>
>>>    regards,
>>>
>>>    Dan.
>>>
>>
>