Subject: [homenet] Kathleen Moriarty's Discuss on draft-ietf-homenet-dncp-09: (with DISCUSS and COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 16 Sep 2015 12:46:11 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-homenet-dncp-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-homenet-dncp/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

 I just have one thing I'd like to discuss that should be easy enough to
resolve.

Section 8 mentions that DTLS or TLS MAY be used and that it is up to the
DNCP profile.  I'd be interested to see the security considerations that
would lead to a recommendation of using session transport for the DNCP
profiles.  If it is in another RFC, could you add a pointer?  If it is
not, could this be added to the security considerations section since it
could be an important consideration?

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for your detailed work on this draft to provide all of the
security related options in section 8.

---

From: Markus Stenberg <[email-masked]>
Date: Thu, 17 Sep 2015 18:53:39 +0300

> could be an important consideration?

Thanks for the comment.

I am actually planning to write one more appendix to the text for -10; it will contain datagram(=e.g. UDP) <> stream(=e.g. TCP) pros and cons as I have been thinking about it every now and then, and I think it would make life of someone else defining a DNCP-based protocol bit easier.

From the security standpoint, there isn’t much of a difference, as the TLS/DTLS state is more or less same for both cases. You will anyway need either up to date sessions (TLS(+DTLS)) and-or long lived session caching (DTLS(+TLS)), as you cannot afford too many new sessions that actually involve the authz step per given time interval. So essentially even DTLS is session-based transport in this case from my point of view.

The rest, I will write it tomorrow and you (and Brian H. who also raised interest on the different transport options) can check it once we publish -10 if it matches the requirements; we plan to publish -10 either tomorrow or on Monday.

Thanks ;) Section 8.3 is actually somewhat novel I think, the others (8.1/8.2) are relatively .. mundane.

Cheers,

-Markus

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 17 Sep 2015 12:11:13 -0400

Thanks, Markus.  inline.

> The rest, I will write it tomorrow and you (and Brian H. who also raised interest on the different transport options) can check it once we publish -10 if it matches the requirements; we plan to pub…

Great, if you could put a couple of lines in the security
considerations section as general guidance, I think that would be very
helpful.  I'm taking tomorrow off (and the rest of today), so Monday
is fine for me.

Thanks,
Kathleen

-- 

Best regards,
Kathleen