Subject: [ippm] Stephen Farrell's Discuss on draft-ietf-ippm-ipsec-09: (with DISCUSS and COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Wed, 08 Apr 2015 09:34:32 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-ippm-ipsec-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-ippm-ipsec/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Are O/TWAMP vulnerable to reflection attacks with this scheme?
If so that's not good. Sorry that I didn't manage to figure
that out in the time available but I'm hoping you can just
tell me the answer quickly:-) If it's not vulnerable, that's
great though it might be worth making that clearer. If it is,
then that seems like a bad plan about which we ought chat.
The usual solution would be to derive different keys for each
direction of use, and just say to use those appropriately.
And even if O/TWAMP are thusly vulnerable with a PSK, it'd be
fine, and quite possible to fix that here now we're doing
better key mgmt.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Since you're touching on the key managment code, I'd have
loved to see you also update the O/TWAMP crypto itself to e.g.
use an AEAD cipher rather than AES-CBC. Did the WG consider
that? (I assume it's too late now, but I'm not clear from the
write-up if this is implemented or not, so I guess there's a
small chance that the WG may want to update more than just the
key mgmt.)

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Wed, 8 Apr 2015 12:57:40 -0400

Hi Stephen, 
a reply to your comment from a non-author--*wamp-watcher below,

> -----Original Message-----
> From: ippm [mailto:[email-masked]] On Behalf Of Stephen Farrell
> Sent: Wednesday, April 08, 2015 12:35 PM
...
> Since you're touching on the key managment code, I'd have loved to see
> you also update the O/TWAMP crypto itself to e.g.
> use an AEAD cipher rather than AES-CBC. Did the WG consider that? (I
> assume it's too late now, but I'm not clear from the write-up if this is
> implemented or not, so I guess there's a small chance that the WG may
> want to update more than just the key mgmt.)
> 

The IPsec feature is an optional capability, and that's the scope limit of
the draft, so it falls far short of replacing the current crypto features.

Way back in <IETF meeting after Dublin>, I investigated using a "more conventional"
crypto for TWAMP (at least for the Control connection)
and asked whether the WG was interested - no takers.
Pasi Eronen (SEC AD at the time) had encouraged the investigation/question2wg 
following the IESG review/approval of the TWAMP spec.
At some future time, the answer might be different.

Al