Subject: Re: [Dots] secdir review of draft-ietf-dots-signal-call-home-11

From: <[email-masked]>
Date: Mon, 2 Nov 2020 07:11:50 +0000

Hi Radia,

Thank you for the review.

Fixed the nit in my local copy.

Cheers,
Med

De : Radia Perlman [mailto:[email-masked]]
Envoyé : dimanche 1 novembre 2020 05:55
À : [email-masked]; The IESG <[email-masked]>; [email-masked]
Objet : secdir review of draft-ietf-dots-signal-call-home-11

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

I didn't find anything objectionable from a security point-of-view in this I-D.

DOTS is a protocol for reporting denial of service attacks to someone closer to the source than you are in hopes they can block such attacks before they have wasted more network bandwidth. The agent reporting the DoS is the DOTS client and the agent receiving the report is the DOTS server. The DOTS protocol is described in other documents.

There is a special case where a DOTS server is running in a "home" network where it is capable of initiating connections but not receiving incoming ones because of NAT or firewall. This document defines a variation of the DOTS protocol for such scenarios where the DOTS server initiates the connection to the DOTS client in order to receive notifications of DoS traffic originating inside the firewalled network. Since authentication uses client and server certificates with TLS or DTLS, little needs to be changed to support this role reversal.

Found one typo:

Section 5.3.2: depictes -> depicts

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.