Subject: [tsvwg] Joel Jaeggli's No Objection on draft-ietf-tsvwg-circuit-breaker-13: (with COMMENT)

From: "Joel Jaeggli" <[email-masked]>
Date: Sun, 13 Mar 2016 10:24:51 -0700

Joel Jaeggli has entered the following ballot position for
draft-ietf-tsvwg-circuit-breaker-13: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tsvwg-circuit-breaker/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

[email-masked]

performed the opsdir review

   Simple protection can be provided by using a randomized source port,
   or equivalent field in the packet header (such as the RTP SSRC value
   and the RTP sequence number) expected not to be known to an off-path
   attacker.  Stronger protection can be achieved using a secure
   authentication protocol.  This attack is relatively easy for an on-
   path attacker when the messages are neither encrypted nor
   authenticated.  When there is a risk of on-path attack, a
   cryptographic authentication mechanism for all control/measurement
   messages is RECOMMENDED to mitigate this concern.

By on-path attacker we mean service provider.

As with for example HLS (which is congestion controlled), and which ISPs
particularly wireless carriers then deliberately degrade; Providing a
protocol with a well understood mechanism for shutting it down can be
used to do so maliciously without imposing a strict firewall policy.
that's convenient for plausible deniability.  I wonder if the technical
response from implementors isn't to wrap the flow in something harder to
inspect.

The discussion of a multicast circuit breaker seems largely anchored in
SSM with respect to there being one (reliable) sender. In the ASM case it
seems trivial for a malicious sender to cause all the other parties to
leave the group by misreporting it's own sending properties (and do so
with very few packets).