Re: [sfc] TR: New Version Notification for draft-rebo-sfc-nsh-integrity-02.txt

Hi Tal,

Thank you for the comment.

The point is recorded and will be addressed in the next iteration: https://github.com/boucadair/sfc-nsh-integrity/issues/3

Cheers,
Med

De : Tal Mizrahi [mailto:tal.mizrahi.phd@gmail.com]
Envoyé : jeudi 28 novembre 2019 15:24
À : BOUCADAIR Mohamed TGI/OLN
Cc : sfc@ietf.org; draft-rebo-sfc-nsh-integrity@ietf.org
Objet : Re: [sfc] TR: New Version Notification for draft-rebo-sfc-nsh-integrity-02.txt

Hi,

A comment regarding the Timestamp format that is defined in Section 5.2.
The Timestamp format should be defined carefully. Please take a look at "Guidelines for Defining Packet Timestamps" (draft-ietf-ntp-packet-timestamps).
I recommend to use the template - Section 3 of draft-ietf-ntp-packet-timestamps. The examples in the draft are pretty helpful.

Cheers,
Tal.

On Wed, Nov 20, 2019 at 12:40 PM <mohamed.boucadair@orange.com<mailto:mohamed.boucadair@orange.com>> wrote:
Hi all,

I'm pleased to share this updated version of this spec. This version integrates a detailed review and inputs from Dan.

FWIW, the main changes are as follows:
* SFFs are not supplied by design with the encryption material
* Motivate why base and service headers are not encrypted
* The inner packet is also integrity protected
* Use of timestamp to protect against replay attacks
* Restructure the design overview section to better highlight the provided security protection services, which elements are involved, etc.
* Add a new section to discuss key management considerations
* Add a new section to discuss NSH-in-NSH
* Add more details to the processing rules
* And many edits.

Comments, question, and suggestions are more than welcome.

Cheers,
Med

> -----Message d'origine-----
> De : internet-drafts@ietf.org<mailto:internet-drafts@ietf.org> [mailto:internet-drafts@ietf.org<mailto:internet-drafts@ietf.org>]
> Envoyé : mercredi 20 novembre 2019 11:27
> À : Dan Wing; Tirumaleswar Reddy; Tirumaleswar Reddy.K; BOUCADAIR Mohamed
> TGI/OLN
> Objet : New Version Notification for draft-rebo-sfc-nsh-integrity-02.txt
>
>
> A new version of I-D, draft-rebo-sfc-nsh-integrity-02.txt
> has been successfully submitted by Mohamed Boucadair and posted to the
> IETF repository.
>
> Name:         draft-rebo-sfc-nsh-integrity
> Revision:     02
> Title:                Integrity Protection for
>     Network Service Header (NSH) and Encryption of Sensitive Context
>     Headers
> Document date:        2019-11-20
> Group:                Individual Submission
> Pages:                26
> URL:            https://www.ietf.org/internet-drafts/draft-rebo-sfc-nsh-
> integrity-02.txt
> Status:         https://datatracker.ietf.org/doc/draft-rebo-sfc-nsh-
> integrity/
> Htmlized:       https://tools.ietf.org/html/draft-rebo-sfc-nsh-integrity-02
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-rebo-sfc-nsh-
> integrity
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-rebo-sfc-nsh-
> integrity-02
>
> Abstract:
>    This specification adds integrity protection and optional encryption
>    of sensitive metadata directly to Network Service Headers (NSH) used
>    for Service Function Chaining (SFC).
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.
>
> The IETF Secretariat

_______________________________________________
sfc mailing list
sfc@ietf.org<mailto:sfc@ietf.org>
https://www.ietf.org/mailman/listinfo/sfc