Subject: [Isis-wg] Kathleen Moriarty's No Objection on draft-ietf-isis-auto-conf-04: (with COMMENT)

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 12 Apr 2017 15:06:38 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-isis-auto-conf-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-isis-auto-conf/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for your response and updates to the SecDir review.
https://mailarchive.ietf.org/arch/msg/secdir/_DxRs_eINTVE8E-N3S31Zr_10B8

I don't see any privacy considerations with the identifiers created,
discussed in System ID and Router-Fingerprint Generation Considerations
and Section 3.2.  Are they in later documents that use these identifiers?
 I see they may not be unique in home networks, but are there
considerations for how they might be used that need to be documented? 
Thanks in advance.

---

From: "Les Ginsberg (ginsberg)" <[email-masked]>
Date: Thu, 13 Apr 2017 00:28:27 +0000

Kathleen -

Thanx for the review. Inline.

> -----Original Message-----
> From: Isis-wg [mailto:[email-masked]] On Behalf Of Kathleen
> Moriarty
> Sent: Wednesday, April 12, 2017 3:07 PM
> To: The IESG
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: [Isis-wg] Kathleen Moriarty's No Objection on draft-ietf-isis-auto-
> conf-04: (with COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> I don't see any privacy considerations with the identifiers created, discussed
> in System ID and Router-Fingerprint Generation Considerations and Section
> 3.2.  Are they in later documents that use these identifiers?

[Les:] The suggested values to be used to generate these identifiers are listed in Section 3.4.5:

  o  MAC address(es)

   o  Configured IP address(es)

   o  Hardware IDs (e.g.  CPU ID)

   o  Device serial number(s)

   o  System clock at a certain specific time

   o  Arbitrary received packet(s) on an interface(s)

(though an implementation is free to use other identifiers).

What about these suggestions indicates there is a privacy concern?

   Les

> 
> 
> _______________________________________________
> Isis-wg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/isis-wg

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 13 Apr 2017 08:39:03 -0400

Hi Les,

Thanks for your quick response.  My question is just at the comment
level as I didn't see any issues, but just wanted to ask the question
as I was not sure how the identifiers might be used.  If they are
combined with user information or in use for home networking
equipment, could user activity be traced.  Identifiers is one of the
issues raised in RFC6973 and how they are used, even if they are
randomly generated.

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Alia Atlas <[email-masked]>
Date: Thu, 13 Apr 2017 09:32:50 -0400

Hi Kathleen,

In this case, the generated identifiers are used for uniqueness so that each
router will have a different System ID.  The identifiers aren't used
otherwise.
The System IDs are flooded throughout the network as part of IS-IS.

I don't see a privacy concern here - but agree that it is good to step back
and
double-check.

Regards,
Alia

On Thu, Apr 13, 2017 at 8:39 AM, Kathleen Moriarty <
[email-masked]> wrote:

> email
> discussed