Re: [TLS] Draft minutes for IETF-75 available

[Gerhard Muenz <[e-mail]>]

Hi,

> Draft minutes for IETF 75 are available here:
> 
> http://www.ietf.org/proceedings/75/minutes/tls.txt
> 
> Let me know if you have corrections.

Probably here:

> 3. DTLS Heartbeat - Presented by Michael Tuexen
> 
> Draft: http://www.ietf.org/internet-drafts/draft-seggelmann-tls-dtls-heartbeat-00.txt
> 
> Pasi Eronen (AD): I can see this being useful in cases, but I can also see
>       it being solved in the lower layer protocols.  EG, in IPFIX I

lower => upper ? (otherwise, it does not make sense)

>       can very much see them solving it at their layer.
> Michael Tuexen: I see your point but...
> Pasi: I can also see this useful for PMTU discovery.
> Michael: That's true but it doesn't necessarily work for bi-directional
> 	differences.  You can another message which contains extra

missing verb?

> 	stuff for doing discovery.  SCTP has opaque data for doing
> 	things like that.  I like the discovery message, but I think
> 	it should be another message.
> Eric (Jabber): this is relevant in TCP cases as well.
> 
> Question: if you use this in UDP, the draft says you must not send them
>       while you're waiting for a response.
> Michael: Only one heart-beat request in flight at a time.  I don't want
> 	to have a congestion control problem
> 
> Wes Hardaker: agree with EKR that it is useful it TCP as well,
>       though you need to document differences.  Longer discussion on
>       the rational behind it.  

Some thoughts about the proposal to solve Heartbeat at the IPFIX layer
(from me as a contributor to IPFIX):
It is extremely unlikely that we will change the IPFIX protocol from
unidirectional to bidirectional just because DTLS-over-UDP requires it.
In my opinion, if we had to choose, it would be more likely that we
would update RFC5101 saying that DTLS is not required any more for
IPFIX-over-UDP implementations, and that the usage of
IPFIX-over-DTLS/UDP is not recommended because of the dead peer
detection problem.
IPFIX cannot reasonably deploy DTLS for UDP without the proposed
Heartbeat extension. The available workarounds are not very nice.

Regards,
Gerhard