Subject: Re: [Tsvwg] Adopt draft-tuexen-tsvwg-dtls-for-sctp

From: Alfred Hönes <[email-masked]>
Date: Tue, 30 Sep 2008 18:28:09 +0200 (MESZ)

At Wed, 17 Sep 2008 17:12:06 +0200 , Magnus Westerlund wrote:

> There wasn't many that had read this document in the meeting in
> Dublin.  However, there are definitely customers that want DTLS
> for SCTP.  So this is a question if people want us to adopt DTLS
> for SCTP as a WG item?  When stating a position please do indicate
> if you intended to help by reviewing and providing comments.
> Please provide input by the 1st of October.

Basically, it is clear that IPsec is not a perfect match for
securing SCTP, since it cannot cope reasonably with the advanced
features of SCTP.  As explained in the draft, TLS over SCTP also
has considerable drawbacks.

With regard to the important infrastructure applications for which
SCTP has been designed, and which are going to use it now, the IETF
should not leave SCTP without a fully specified security solution.

The draft aims at defining a combined profile of DTLS over SCTP
that allows to secure SCTP associations at the transport layer
without requiring tradeoffs in the SCTP feature set.

Hence, the IETF should tackle this work.

I already had commited some time to this draft and sent a few
comments.  Since the document is not yet complete, I'd prefer
to see some discussion and updates before performing a more
detailed review; but I commit to do that.

However, the problem is that there's no perfect match in the
current WG spectrum of the IETF for this topic.  TSVWG has
become the home of SCTP, but might not be the proper forum for
TLS/DTLS related details; TLS already has started an effort to
update the DTLS specification, for general maintenance and in
order to align it with TLS 1.2.
So perhaps TSVWG is not ideal, but is it TLS ?
The author team already spans both groups, but now the
question is how to best share additional knowledge and
experience in both fields!

Best regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+

---

From: Michael Tüxen <[email-masked]>
Date: Tue, 30 Sep 2008 20:51:35 +0200

Hi Alfred,

thanks for your statement! Please see some comments
in-line.

Best regards
Michael

> detailed review; but I commit to do that.
That is great. Thank you very much in advance.
> So perhaps TSVWG is not ideal, but is it TLS ?
I think neither TSVWG nor TLS is "ideal" or "perfect".
However, my personal opinion is (I already presented an
early version of DTLS also in the TLS WG) that TSVWG
seems a bit more appropriate, since we do not touch
DTLS, use SCTP AUTH (which was developed in TSVWG) and
have some relation to the SCTP socket API (which is
in TSVWG), since DTLS/SCTP uses the socket API to
access the SCTP functionality.
> experience in both fields!
Not sure, maybe the ADs can make a decision on that, but
one could drop a note to the TLS WG when the WG LC is
running...
>
>
>
> Best regards,
>  Alfred.
>
> --  
>
> +------------------------ 
> +--------------------------------------------+
> +------------------------ 
> +--------------------------------------------+
>
>