Subject: [nvo3] Commnets on draft-ietf-nvo3-security-requirements-00.txt

From: Zu Qiang <[email-masked]>
Date: Wed, 16 Oct 2013 17:30:04 +0000

Hello, Authors
	I have a few comments on the draft which I have sent to a few weeks ago. Based on the offline discussions I have also added all my comments into a draft for a better WG discussion. http://tools.ietf.org/html/draft-zu-nov3-security-requirements-01
	I can summarize my comments here:
-  the NVO3 network security requirement draft shall allow additional security mechanisms other than key management.
-  different network architecture may have different network security requirements which is missing in this draft. 
- as a requirement document, it would be good to have all requirements list in bullets which will be easier for an implementation to indicate which requirement it has supported. 
	Hope this helps. 

Have a nice day
Zu Qiang

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf Of
>[email-masked]
>Sent: Tuesday, October 15, 2013 6:08 AM
>To: [email-masked]
>Cc: [email-masked]
>Subject: [nvo3] I-D Action: draft-ietf-nvo3-security-requirements-00.txt
>
>
>A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Network Virtualization Overlays Working
>Group of the IETF.
>
>	Title           : Security Requirements of NVO3
>	Author(s)       : Sam Hartman
>                          Dacheng Zhang
>                          Margaret Wasserman
>	Filename        : draft-ietf-nvo3-security-requirements-00.txt
>	Pages           : 13
>	Date            : 2013-09-28
>
>Abstract:
>   This draft discusses the security requirements and several issues
>   which need to be considered in securing a virtualized data center
>   network for multiple tenants (a NVO3 network for short).  In
>   addition, the draft also attempts to discuss how such issues could be
>   addressed or mitigated.
>
>
>
>The IETF datatracker status page for this draft is:
>https://datatracker.ietf.org/doc/draft-ietf-nvo3-security-requirements
>
>There's also a htmlized version available at:
>http://tools.ietf.org/html/draft-ietf-nvo3-security-requirements-00
>
>
>Please note that it may take a couple of minutes from the time of submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>Internet-Drafts are also available by anonymous FTP at:
>ftp://ftp.ietf.org/internet-drafts/
>
>_______________________________________________
>nvo3 mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/nvo3

---

From: "Zhangdacheng (Dacheng)" <[email-masked]>
Date: Thu, 17 Oct 2013 07:31:17 +0000

The Zu:

I just came back from a business journey and saw your email. Thanks a lot for your comments. See my reply please.

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Zu
> Qiang
> Sent: Thursday, October 17, 2013 1:30 AM
> To: [email-masked]
> Subject: [nvo3] Commnets on draft-ietf-nvo3-security-requirements-00.txt
> 
> Hello, Authors
> 	I have a few comments on the draft which I have sent to a few weeks ago.
> Based on the offline discussions I have also added all my comments into a draft
> for a better WG discussion.
> http://tools.ietf.org/html/draft-zu-nov3-security-requirements-01
[Dacheng Zhang:] 
Maybe you misunderstood our points, we never try to argue the security solutions other than key management should not be used, although we do introduce how to use key management mechanisms to mitigate different security issues
> -  different network architecture may have different network security
> requirements which is missing in this draft.
[Dacheng Zhang:] 
I will think of this. It would be helpful to give us some examples of different types of network architectures that we need to consider. Do you mention them in your document?

> - as a requirement document, it would be good to have all requirements list in
> bullets which will be easier for an implementation to indicate which
> requirement it has supported.
> 	Hope this helps.
> 
> Have a nice day
> Zu Qiang
> 
>

---

From: Zu Qiang <[email-masked]>
Date: Thu, 17 Oct 2013 12:55:10 +0000

Thanks Dacheng for your response.  See inline.

Have a nice day
Zu Qiang

>From: Zhangdacheng (Dacheng) [mailto:[email-masked]]
>Sent: Thursday, October 17, 2013 3:31 AM
>To: Zu Qiang; [email-masked]
>Subject: RE: [nvo3] Commnets on draft-ietf-nvo3-security-requirements-
>00.txt
>
>The Zu:
>
>> From: [email-masked] [mailto:[email-masked]] On Behalf
>> Of Zu Qiang
>> Subject: [nvo3] Commnets on
>> draft-ietf-nvo3-security-requirements-00.txt
>>
>> Hello, Authors
>> Based on the offline discussions I have also added all my comments
>> into a draft for a better WG discussion.
>> -  the NVO3 network security requirement draft shall allow additional
>> security mechanisms other than key management.
>[Dacheng Zhang:]
>Maybe you misunderstood our points, we never try to argue the security
>solutions other than key management should not be used, although we do
>introduce how to use key management mechanisms to mitigate different
>security issues
[Zu Qiang] my point is that there is no other security mechanisms (except key management) have been discussed in the draft.

>I will think of this. It would be helpful to give us some examples of different
>types of network architectures that we need to consider. Do you mention
>them in your document?
[Zu Qiang] I have sent this comment weeks ago. Hope you had time to think about it. Please read my draft. You can find enough reference text there. 

>> requirement it has supported.
[Zu Qiang] Is this also considered?

---

From: Lucy yong <[email-masked]>
Date: Thu, 17 Oct 2013 18:50:20 +0000

[snip]
[Zu Qiang] my point is that there is no other security mechanisms (except key management) have been discussed in the draft.
[Lucy] An easy way to address this is to describe the key management as an example only in the requirement draft. Thus it does not exclude other security mechanisms.

Cheers,
Lucy

---

From: Melinda Shore <[email-masked]>
Date: Thu, 17 Oct 2013 11:13:10 -0800

On 10/17/13 10:50 AM, Lucy yong wrote:

> [Zu Qiang] my point is that there is no other security mechanisms
> (except key management) have been discussed in the draft. [

> Lucy] An
> easy way to address this is to describe the key management as an
> example only in the requirement draft. Thus it does not exclude other
> security mechanisms.

I'm sorry, but I do not understand this discussion at all.
How keys are managed matters a lot (where "a lot" means
"critically important") in terms of the overall security of
the system.  We are sloppy about it at our own peril.

The assertion that nothing but key management is discussed
in the working group draft is very clearly incorrect.  I do
not understand "we never try to argue the security solutions
other than key management should not be used" because key
management is not a security solution in the first place -
it's a technology that's part of the overall security solution
(not really fond of the word "solution", anyway).  Too many
of Zu's requirements are really squishy and not actually
requirements, and the bottom line is that I wish he were working
with the security document authors and posting text to the
mailing list rather than posting a competing draft.  But most
of all I cannot believe that someone who writes "the NVO3 network
security requirement draft shall allow additional security
mechanisms other than key management" has read the working group
draft.

I apologize for being harsh but I don't think that posting
a large document is a productive way to tackle deficiencies,
real or perceived, in the working group draft, the suggestion
that there's nothing in there but key management is clearly
wrong, and the discussion about key management vs. other
security mechanisms is both confused and confusing.

Melinda

---

From: Lucy yong <[email-masked]>
Date: Thu, 17 Oct 2013 19:35:21 +0000

Melinda,

Sorry to set you up. I did not read both drafts and did not indicate to include Zu's draft at all.

All my response is based on these debates.

It seems two people across each other in understanding. So I make the suggestion. If this is my wrong understanding, please ignore it.

Regards,
Lucy

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Melinda Shore
Sent: Thursday, October 17, 2013 2:13 PM
To: [email-masked]
Subject: Re: [nvo3] Commnets on draft-ietf-nvo3-security-requirements-00.txt

I'm sorry, but I do not understand this discussion at all.
How keys are managed matters a lot (where "a lot" means "critically important") in terms of the overall security of the system.  We are sloppy about it at our own peril.

The assertion that nothing but key management is discussed in the working group draft is very clearly incorrect.  I do not understand "we never try to argue the security solutions other than key management should not be used" because key management is not a security solution in the first place - it's a technology that's part of the overall security solution (not really fond of the word "solution", anyway).  Too many of Zu's requirements are really squishy and not actually requirements, and the bottom line is that I wish he were working with the security document authors and posting text to the mailing list rather than posting a competing draft.  But most of all I cannot believe that someone who writes "the NVO3 network security requirement draft shall allow additional security mechanisms other than key management" has read the working group draft.

I apologize for being harsh but I don't think that posting a large document is a productive way to tackle deficiencies, real or perceived, in the working group draft, the suggestion that there's nothing in there but key management is clearly wrong, and the discussion about key management vs. other security mechanisms is both confused and confusing.

Melinda

---

From: Melinda Shore <[email-masked]>
Date: Thu, 17 Oct 2013 11:49:22 -0800

I should add that Zu is correct about the format of the document -
to me, it reads more like a framework draft than a requirements
draft.  I think it's useful discussion and that it does belong
somewhere, with options being

1) in a requirements draft, with actual requirements
   extracted and bulleted;
2) moved into other nvo3 framework documents; or
3) turned into its own document

I think the last one would be rather a bad idea but can live
with either of 1 or 2.

Melinda

---

From: Zu Qiang <[email-masked]>
Date: Mon, 21 Oct 2013 19:14:34 +0000

>and not actually requirements, and the bottom line is that I wish he were
>working with the security document authors and posting text to the mailing
>list rather than posting a competing draft.  
[Zu Qiang] I did have the proposed text sent to the authors before the submission of the draft. However, I didn't receive any feedback. 

Have a nice day
Zu Qiang

---

From: Melinda Shore <[email-masked]>
Date: Mon, 21 Oct 2013 11:21:00 -0800

On 10/21/13 11:14 AM, Zu Qiang wrote:
> [Zu Qiang] I did have the proposed text sent to the authors before
> the submission of the draft. However, I didn't receive any feedback.

As I've said, I think the most productive way to proceed would
be to post one or several (as long as they're related) proposed
requirements to the mailing list and try to get some agreement
around those.  Given the difficulty of getting reviews for
working group documents it seems to me that anything you can
do to reduce the effort on the part of working group participants
makes it easier to progress.

Melinda