Subject: [ippm] Ben Campbell's Discuss on draft-ietf-ippm-ipsec-09: (with DISCUSS and COMMENT)

From: "Ben Campbell" <[email-masked]>
Date: Tue, 07 Apr 2015 14:59:44 -0700

Ben Campbell has entered the following ballot position for
draft-ietf-ippm-ipsec-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-ippm-ipsec/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

In the last paragraph, the text indicates that if the IKEv2 SA is rekeyed
or deleted, O/TWAMP can continue to use the same shared secret. The
language seems to make such a continuance optional. Does that cause an
interoperability problem if the endpoints don't agree on the strategy?

If so, this may need a 2119 MUST (or possibly SHOULD).

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Section 1, paragraph 4:

This paragraph casts the decision whether to send O/TWAMP inside or
outside of an IPSec tunnel as a question of how you want to secure the
O/TWAMP packets. It seems to me that this is really more a matter of what
you want to measure, given that the tunneled data and non-tunneled data
may have different performance capabilities. 

Sentence starting with "In this case...": The antecedent of "this" is
unclear.

Section 1, 2nd to last paragraph:

I assume the last sentence means that IKEv2 derived keys SHOULD be used
instead of shared secrets when otherwise using IKEv2. That seems to add a
normative requirement to OWAMP and TWAMP in general, in which case this
doc should be listed as updating those.

Section 3:

I agree with Brian's DISCUSS.

Section 4.1:

Please expand HMAC on first mention.

Section 5.1: 

"SK_d MUST be computed as per [ref]" :That doesn't need 2119 language.

"string "IPPM" comprises four ASCII characters ": This is oddly
constructed. Is this intended to observe that IPPM has 4 letters?

Section 5.2, paragraph after Figure 2: "Clearly, an implementation ....
MUST ..."

It is not as clear to me. Why does the use of IKEv2 create a stronger
requirement to support all 3 protection modes?

Section 5.3:, first paragraph:

"The Set-Up-Response Message should be updated": Do you mean to say it
_is_ updated?

Paragraph after figure 3:

s/ "can uniquely identify" / "uniquely identifies"

5.4, last sentence:

The sentence is confusing. Do you mean to say that O/TWAMP SHOULD be
configured to use the tunnel?