Subject: [CDNi] Ben Campbell's Discuss on draft-ietf-cdni-control-triggers-11: (with DISCUSS and COMMENT)

From: "Ben Campbell" <[email-masked]>
Date: Tue, 05 Jan 2016 19:40:20 -0800

Ben Campbell has entered the following ballot position for
draft-ietf-cdni-control-triggers-11: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cdni-control-triggers/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I've got two concerns that I think  leave  ambiguity around important
normative requirements. Hopefully they will be easy to resolve:

- 4.7, 2nd bullet under handling of offline surrogates:

I assume I am missing something here. How does a surrogate know that the
situation exists in the first place? How would a surrogate know about
invalidate commands that happened while it was offline?

- 8.1,  4th paragraph from the end:
The language here is ambiguous about whether the use of TLS is _always_
required, or just when "such protection is required." From context, I
assume the latter to be the case. But "To that end..." can be interpreted
to mean "In that case, one MUST do X", or to mean "In order to make that
possible when needed, one MUST _always_ do X"

I propose the following:
OLD:
   In an environment where any such protection is required, mutually
   authenticated encrypted transport MUST be used to ensure
   confidentiality of the CI/T information.  To that end, TLS MUST be
   used by CI/T, including authentication of the remote end.
NEW:
   In an environment where any such protection is required, mutually
   authenticated and encrypted TLS MUST be used to ensure
   confidentiality of the CI/T information. 
END.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

- 3, paragraph 5:
SHOULD should not be equated with "optional to implement". MAY means
that. SHOULD is intended to be stronger.

- 4.5, 2nd paragraph, 1st sentence:
This is pretty convoluted. I suggest reformulating without the past tense
"MUST". For example, "The dCNI MUST report the expiration times if..."

-4.6: "If CDNs B and C delegate delivery of CDN A’s content to each
other"
Is this a reasonable configuration? It seems like they might already have
a delegation loop before the trigger interface got involved.
Also, the first sentence is a fragment.

= 4.8, first paragraph:
I suggest s/transform/"similarly transform"

- 5.1.3, staleresourcetime, mandatory:
Doesn't this effectively mean the value must be the same across all
collections? 

- 5.2.1, content.ccid:
Seems like the reference to [I-D.ietf-cdni-metadata] should be
normative.

- 6.2.5:
it looks like the dCDN is sending the request to itself. Is that the
intent?

- 8.1, last paragraph: "In this case, the dCDN MUST allow each uCDN from
which the content could have been acquired to act upon that content using
CI/T Commands."
This seems like a place where local policy might reasonably vary. Is a
MUST really appropriate?

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 06 Jan 2016 09:29:56 -0600

On 6 Jan 2016, at 9:14, Kathleen Moriarty wrote:

> I'm interested to see the response on this discuss.  From reading the
> Security Considerations, I thought that TLS would be required for the
> commercial confidentiality concerns cited in 8.3 and to provide the
> security properties cited in 8.1.
>
> I agree with Ben that the language goes back and forth a bit as to
> whether or not it is required (I'd prefer to see it required.
> However, there is enough language to suggest that it is just required
> when specific conditions are met.  If there is a good argument to keep
> it as-is, Ben's suggested language helps clear up any confusion, but
> I'd like to make sure that there is a good reason to not have this be
> a MUST use TLS.
>
> I'm going to just tack this onto Ben's discuss as I should be on
> maternity leave soon and don't want to hold up the draft while I am
> out if this isn't resolved quickly.

For the record, my proposed text assumed the intent was for a 
conditional "MUST use TLS". If the answer turned out to be "always 
MUST", I would certainly not object.

Ben.