Subject: Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09

From: Lou Berger <[email-masked]>
Date: Fri, 15 May 2020 10:42:47 -0400

To follow up on this LC -- the LC is closed, but (as I understand it) 
there is one unresolved issue.

Authors,

     do you have a plan to address the open issue, or do you still need 
some additional input?

Lou

On 4/20/2020 11:00 AM, Lou Berger wrote:
> All,
>
> This starts a two-week working group last call for
> draft-ietf-detnet-security-09
>
> The working group last call ends on April 4.
> Please send your comments to the working group mailing list.
>
> Positive comments, e.g., "I've reviewed this document
> and believe it is ready for publication", are welcome!
> This is useful and important, even from authors.
>
> Thank you,
> Lou (DetNet Co-Chair & doc Shepherd)
>
> _______________________________________________
> detnet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/detnet
>

---

From: "Grossman, Ethan A." <[email-masked]>
Date: Fri, 15 May 2020 17:09:38 +0000

Hi Lou,
As I understand it, there are two unresolved issues from David Black's last email. These are: 

> [5-Major] Section 5.8 seems incomplete.   It contains a sizeable summary table
> of attacks, impacts and mitigations, but doesn't provide 
> recommendations on what to do.  Scanning the mitigations column, a 
> good start would be to characterize control message protection and 
> performance analytics as [MUST implement, SHOULD use] and the combination of DetNet authentication and
> integrity protection as [MUST implement, MAY use].   Both "MUST"
> requirements are my initial take that I'd be happy to discuss further.
> 
> [6-Major] Section 7.1 on the IP data plane seems rather weak - I'm not 
> sure whether it says anything that's seriously useful.  Section 7.2 on 
> the MPLS data plane is much better in directing the reader to relevant 
> security considerations in other documents.

In short, yes, I still need input on these; I can't resolve them myself. 

Ethan (as DetNet Security draft editor). 

-----Original Message-----
From: Lou Berger <[email-masked]> 
Sent: Friday, May 15, 2020 7:43 AM
To: DetNet WG <[email-masked]>
Cc: [email-masked]
Subject: Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09

To follow up on this LC -- the LC is closed, but (as I understand it) there is one unresolved issue.

Authors,

     do you have a plan to address the open issue, or do you still need some additional input?

Lou

On 4/20/2020 11:00 AM, Lou Berger wrote:
> Positive comments, e.g., "I've reviewed this document and believe it 
> is ready for publication", are welcome!

---

From: Lou Berger <[email-masked]>
Date: Fri, 15 May 2020 15:47:24 -0400

Hi Ethan,

>> requirements are my initial take that I'd be happy to discuss further.

There were two points on this, in david's response.

1) there was agreement that conformance language was *not* needed, but that

2) the draft should "provide concise recommendations to implementers on 
what to do."

I took this as an editorial comment that the authors would address.  Do 
you think otherwise?

> In short, yes, I still need input on these; I can't resolve them myself.

Skimming this section the biggest omissions are  security considerations 
in prior work. I think it worth while to review the security 
considerations in [RFC2474] and [RFC2475] and see if content is missing 
from this document (probably in section 3) or if a simple reference 
should be added.  Once this is done,  I can also note in the 
Shepherd/PROTO write-up that this document has already been informally 
reviewed by the security directorate and that this section has been 
identified as needing specific review (in the context of the rest of the 
document).

So I think the action is back on you/the authors to look at the security 
considerations in [RFC2474] and [RFC2475], update this draft 
accordingly, and then report back to the WG. Of course if someone else 
wishes they can propose a specific update to the WG document on the 
list, and this would be most welcome.

Does this work for you and the other authors?

Thanks,

Lou

---

From: "Grossman, Ethan A." <[email-masked]>
Date: Fri, 15 May 2020 20:10:29 +0000

Hi Lou,
Comments inline. 
Ethan (EAG).

-----Original Message-----
From: Lou Berger <[email-masked]> 
Sent: Friday, May 15, 2020 12:47 PM
To: Grossman, Ethan A. <[email-masked]>; DetNet WG <[email-masked]>
Cc: [email-masked]; Black, David <[email-masked]>
Subject: Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09

Hi Ethan,

2) the draft should "provide concise recommendations to implementers on what to do."

I took this as an editorial comment that the authors would address.  Do you think otherwise?

EAG: That is exactly how I take it; the issue is that I cannot find an author who is both willing and able to address this. In other words, I don't have the domain knowledge to "tell implementers what to do", and so far no-one else has stepped up. 

>> [6-Major] Section 7.1 on the IP data plane seems rather weak - I'm 
>> not sure whether it says anything that's seriously useful.  Section 
>> 7.2 on the MPLS data plane is much better in directing the reader to 
>> relevant security considerations in other documents.

Skimming this section the biggest omissions are  security considerations in prior work. I think it worth while to review the security considerations in [RFC2474] and [RFC2475] and see if content is missing from this document (probably in section 3) or if a simple reference should be added.  Once this is done,  I can also note in the Shepherd/PROTO write-up that this document has already been informally reviewed by the security directorate and that this section has been identified as needing specific review (in the context of the rest of the document).

So I think the action is back on you/the authors to look at the security considerations in [RFC2474] and [RFC2475], update this draft accordingly, and then report back to the WG. Of course if someone else wishes they can propose a specific update to the WG document on the list, and this would be most welcome.

EAG: OK, regarding item #6 I can read the Security sections of RFCs 2474 and 2475 and incorporate what is relevant from them, or include a reference to them. Regarding item #5, I am still at an impasse unless I have specific actionable guidance such as what you have proposed for #6; if you can point me in a specific direction, and I can understand what is being asked (within a reasonable amount of study time), then I am willing to do the work. 

Thanks,

Lou