Re: [secdir] Adrian Farrel's Discuss on draft-ietf-ippm-rt-loss-03: (with DISCUSS and COMMENT)

[Al Morton <[e-mail]>]

Hi Adrian,

Thanks for your reply.
We've narrowed the discussion down to two issues.
see below,

At 01:02 PM 4/7/2012, Adrian Farrel wrote:
> > > > General observation: It's not clear to me what the IPPM WG strategy
> > > > is for security considerations sections in metric definition
> > > > documents.  For example, the security section of this document more or
> > > > less repeats the one in (for example) RFC 2681, which itself
> > > > duplicates verbatim the one in RFC 2680, and the issues discussed are
> > > > general ones with measurement protocols rather than specific ones with
> > > > the metric that is the subject of the document.  There's probably a
> > > > better way to organize this.
> >
> > Although IPPM has never formalized a strategy, we have been repeating
> > security material in metrics RFCs. This allows new folks to read
> > and improve the text, rather than be referred to a fixed reference.
> > It seems to work.
>
>I can see how that would lead to the verbatim reproduction of text. I have no
>problem with that per se, but I worry that the process has become formulaic
>without any new consideration of security for the specific document in hand.
>
>If you tell me that this is adequate for this document and no refinement is
>needed in this case, I will clear and let the Security ADs and 
>Directorate worry
>about the security details.

I think it is. We are essentially conducting a two-way version of RFC 2680
(one-way loss), so all the same considerations apply. We have exposure in
two (possibly different) paths, but the threats are the same.


>...
> > > > Nits:
> > > >
> > > > 1. The phrase "as immediately as possible" that appears a couple of
> > > > times in the text (and that seems to originate in RFC 5357) is a bit
> > > > unfortunate.  "Immediately" or "as quickly as possible" are better.
> >
> > This odd turn of phrase resulted from many hours of discussion
> > dating back to TWAMP's development.  We wear the scar proudly.
>
>Well, this is only a Comment, and you do not have to address it, but "as
>immediately as possible" is hogwash. It is a butchery of the 
>language and means
>nothing!
>
>In fact, and as a general principle of writing standards, even "as quickly as
>possible" would be poor. The English would be fine, but it is a subjective
>statement against which conformance cannot be measured.

Under typical protocol development circumstances, we could write a
real requirement:
         The response MUST be prepared and sent on the wire in <X seconds.

But that's not the case here.  Instead we have desire that the response
will be sent immediately, yet we understand that measurement systems will:

  - occasionally execute higher priority processes that delay the response
    (processing routing updates comes to mind)
  - carry 2 time stamps that allow the tester to determine if the response
    was generated fast enough for the intended purpose
  - serve purposes with greater or lesser need for immediacy
  - either meet the variable needs for measurement immediacy or not, and
    this is a judgement that can be made on each and every measurement packet

Is it useful to explain some/all of this in the memo?

regards,
Al