Subject: [Drip] Fwd: IETF 108 DRIP session follow-up 2 of 4: PRIV-2 Encrypted Transport?

From: "Stuart W. Card" <[email-masked]>
Date: Thu, 30 Jul 2020 13:01:29 -0400

drip@ alias did not work so forwarding to tm-rid@

-------- Forwarded Message --------
Subject: IETF 108 DRIP session follow-up 2 of 4: PRIV-2 Encrypted Transport?
Date: Thu, 30 Jul 2020 12:59:37 -0400
From: Stuart W. Card <[email-masked]>
To: [email-masked]

-reqs-03 PRIV-2:

"DRIP MUST enable selective strong encryption of private data in motion
in such a manner that only authorized actors can recover it.  If
transport is via IP, then encryption MUST be end-to-end, at or above the
IP layer.  DRIP MUST NOT encrypt safety critical data to be transmitted
over Broadcast RID unless also concurrently sending that data via
Network RID and obtaining frequent confirmations of receipt."

Sorry, this reflected solution-space thinking by me, not suitable for a
requirements document; but the objective still needs to be captured.

Bob’s 1st suggestion:

"...  If transport is via IP, then encryption MUST be at or above the IP
layer (not only beneath IP)."

i.e., he drops "end to end" and appends the parenthetical note.

Bob’s 2nd suggestion:

replace "DRIP MUST NOT encrypt safety critical data to be transmitted
over Broadcast RID unless also concurrently sending that data via
Network RID and obtaining frequent confirmations of receipt."

with "Private data encryption MUST conform with CAA policies and
procedures.  That is there MAY be times and locations where encryption
is NOT allowed and the UAS MUST be able to conform to these rules."

This gets the solution approach out of the requirements, with which
change I totally agree. However, it limits the encryption exception to
CAA rules. There are other applicable regulators (e.g. in the US, it is
not just FAA but also FCC and maybe others). Independent of regulations,
we should recognize that transparency of safety-critical information
trumps privacy of operators in situations where the UAS sender cannot be
reasonably confident that legitimate security and safety personnel can
decrypt the Pilot/GCS location in its Broadcast RID System Message
(which it would be hard for them to do w/o Internet connectivity, which
they may not have when listening to Broadcast RID, which runs over local
non-IP RF Line Of Sight data links).

Your opinions on what PRIV-2 should substantially say are solicited, as
this is the main point that must be resolved to wrap up this draft.

-- 
-----------------------------------------
Stuart W. Card, PhD, Principal Engineer
AX Enterprize, LLC  www.axenterprize.com
4947 Commercial Drive, Yorkville NY 13495