From nobody Sat Dec 1 03:16:01 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48C39130DBE for ; Sat, 1 Dec 2018 03:16:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BC2tC983hcVT for ; Sat, 1 Dec 2018 03:15:58 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C784F12F1A5 for ; Sat, 1 Dec 2018 03:15:57 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wB1BFldZ032207 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 1 Dec 2018 12:15:48 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wB1BFnLk020802; Sat, 1 Dec 2018 12:15:49 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 8DFC649DE4; Sat, 1 Dec 2018 12:15:53 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id 7V0NPpenvYkV; Sat, 1 Dec 2018 12:15:52 +0100 (CET) Received: from pirx.irif.fr (unknown [78.194.40.74]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 8F77F49DE2; Sat, 1 Dec 2018 12:15:51 +0100 (CET) Date: Sat, 01 Dec 2018 12:15:51 +0100 Message-ID: <874lbxh508.wl-jch@irif.fr> From: Juliusz Chroboczek To: Toke =?ISO-8859-1?Q?H=F8iland-J=F8rgensen?= Cc: Markus Stenberg , Dave =?ISO-8859-1?Q?T=E4ht?= , babel-users , babel@ietf.org In-Reply-To: <87o9a6pumz.fsf@toke.dk> References: <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <871s78x7z0.fsf@toke.dk> <2D09D61DDFA73D4C884805CC7865E6114DF44154@GAALPA1MSGUSRBF.ITServices.sbc.com> <87pnurwo5e.fsf@toke.dk> <87o9a9v3c6.fsf@toke.dk> <875zwhxv28.wl-jch@irif.fr> <8736rl16yj.fsf@taht.net> <87lg5cxuql.fsf@taht.net> <1C6B19AE-EAA7-4329-A364-8E4C059DAC01@iki.fi> <87woouq24j.fsf@toke.dk> <87in0e6c6v.wl-jch@irif.fr> <87o9a6pumz.fsf@toke.dk> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sat, 01 Dec 2018 12:15:49 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sat, 01 Dec 2018 12:15:49 +0100 (CET) X-Miltered: at korolev with ID 5C026D63.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C026D65.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C026D63.001 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C026D65.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C026D63.001 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C026D65.000 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] Blake2S, blake2B or neither? [was: rather than ripemd160...] X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Dec 2018 11:16:00 -0000 >> (1) leave the document as it is; >> (2) add a mention that implementation of Blake2S is RECOMMENDED (SHOULD); >> (3) add a mention that implementation of Blake2B is RECOMMENDED; >> (4) add a mention that implementation of both 2B and 2S is RECOMMENDED. > I'm in favour of (2). Where is Blake2S-based HMAC defined? RFC 7693 merely says: BLAKE2 does not require a special "HMAC" (Hashed Message Authentication Code) construction for keyed message authentication as it has a built-in keying mechanism. but it does not appear to clearly define the HMAC construction. From nobody Sat Dec 1 11:10:42 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C83D130E2B for ; Sat, 1 Dec 2018 11:10:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jD6eweDfJUAe for ; Sat, 1 Dec 2018 11:10:38 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 221C1130E23 for ; Sat, 1 Dec 2018 11:10:38 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1543691402; bh=MhA9r0tEORLVKQc96OHBxB41ZRS5X057P6krrbKu/Nk=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=c23ATayFRXYXkyEkVaFC5P1D9ri8/46vBYNP0VVZJ7frLtkQPMF9ZbA/C82J4raGs npy3r+E+q6qrVUsaUyh7DyJvkKwTsm3JkWQOXcNNTpDTqN9wv230lcOfCc6t8uxOO+ iUL8mpqCCAqTF9OdaxbIXwuqfq+KM1Czq5pvJjmGBfKGLMNIU6kGWM1ke0TF1MMrZC ewK79d6vPvyBr0SKjgzykbKEeRNjdwL/d0NQDTQOHvTaETjlnYikbqly37AZHMBfmI P1jqUATWOIxUDmB2iZHLBEhTDfAA0xrVYf2by1TEA3/HZSnHpjxyzHFIxKQlExaXCI dM8XUZb/KKsXQ== To: Juliusz Chroboczek Cc: Markus Stenberg , Dave =?utf-8?Q?T=C3=A4ht?= , babel-users , babel@ietf.org In-Reply-To: <874lbxh508.wl-jch@irif.fr> References: <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <871s78x7z0.fsf@toke.dk> <2D09D61DDFA73D4C884805CC7865E6114DF44154@GAALPA1MSGUSRBF.ITServices.sbc.com> <87pnurwo5e.fsf@toke.dk> <87o9a9v3c6.fsf@toke.dk> <875zwhxv28.wl-jch@irif.fr> <8736rl16yj.fsf@taht.net> <87lg5cxuql.fsf@taht.net> <1C6B19AE-EAA7-4329-A364-8E4C059DAC01@iki.fi> <87woouq24j.fsf@toke.dk> <87in0e6c6v.wl-jch@irif.fr> <87o9a6pumz.fsf@toke.dk> <874lbxh508.wl-jch@irif.fr> Date: Sat, 01 Dec 2018 20:09:59 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87sgzhjc6w.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] Blake2S, blake2B or neither? [was: rather than ripemd160...] X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Dec 2018 19:10:40 -0000 Juliusz Chroboczek writes: >>> (1) leave the document as it is; >>> (2) add a mention that implementation of Blake2S is RECOMMENDED (SHOULD); >>> (3) add a mention that implementation of Blake2B is RECOMMENDED; >>> (4) add a mention that implementation of both 2B and 2S is RECOMMENDED. > >> I'm in favour of (2). > > Where is Blake2S-based HMAC defined? RFC 7693 merely says: > > BLAKE2 does not require > a special "HMAC" (Hashed Message Authentication Code) construction > for keyed message authentication as it has a built-in keying > mechanism. > > but it does not appear to clearly define the HMAC construction. Section 3.3 simply says: If a secret key is used (kk > 0), it is padded with zero bytes and set as d[0]. Otherwise, d[0] is the first data block. The final data block d[dd-1] is also padded with zero to "bb" bytes (16 words). -Toke From nobody Sat Dec 1 11:48:06 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BF0F130E4B for ; Sat, 1 Dec 2018 11:48:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h5k6mJO6LvBl for ; Sat, 1 Dec 2018 11:48:02 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 696C0130E35 for ; Sat, 1 Dec 2018 11:48:02 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wB1JlqTH028266 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 1 Dec 2018 20:47:54 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wB1JlsSx026014; Sat, 1 Dec 2018 20:47:54 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id C1FBC4E903; Sat, 1 Dec 2018 20:47:58 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id E4yFPRv6AaUj; Sat, 1 Dec 2018 20:47:56 +0100 (CET) Received: from pirx.irif.fr (unknown [78.194.40.74]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 07CCE4E8FA; Sat, 1 Dec 2018 20:47:54 +0100 (CET) Date: Sat, 01 Dec 2018 20:47:53 +0100 Message-ID: <87o9a5f2qe.wl-jch@irif.fr> From: Juliusz Chroboczek To: Toke =?ISO-8859-1?Q?H=F8iland-J=F8rgensen?= Cc: Markus Stenberg , babel-users , babel@ietf.org In-Reply-To: <87sgzhjc6w.fsf@toke.dk> References: <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <871s78x7z0.fsf@toke.dk> <2D09D61DDFA73D4C884805CC7865E6114DF44154@GAALPA1MSGUSRBF.ITServices.sbc.com> <87pnurwo5e.fsf@toke.dk> <87o9a9v3c6.fsf@toke.dk> <875zwhxv28.wl-jch@irif.fr> <8736rl16yj.fsf@taht.net> <87lg5cxuql.fsf@taht.net> <1C6B19AE-EAA7-4329-A364-8E4C059DAC01@iki.fi> <87woouq24j.fsf@toke.dk> <87in0e6c6v.wl-jch@irif.fr> <87o9a6pumz.fsf@toke.dk> <874lbxh508.wl-jch@irif.fr> <87sgzhjc6w.fsf@toke.dk> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sat, 01 Dec 2018 20:47:54 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sat, 01 Dec 2018 20:47:54 +0100 (CET) X-Miltered: at korolev with ID 5C02E568.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C02E56A.002 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C02E568.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C02E56A.002 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C02E568.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C02E56A.002 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] Blake2S, blake2B or neither? [was: rather than ripemd160...] X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Dec 2018 19:48:04 -0000 >> Where is Blake2S-based HMAC defined? RFC 7693 merely says > Section 3.3 simply says: > If a secret key is used (kk > 0), it is padded with zero bytes and > set as d[0]. Otherwise, d[0] is the first data block. The final > data block d[dd-1] is also padded with zero to "bb" bytes (16 words). Thanks, that was the bit I'm missing. With that info, I have no objection to making Blake2S RECOMMENDED in Babel-HMAC. I'm still waiting for more opinions before I make up my mind. -- Juliusz From nobody Sat Dec 1 11:53:00 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C834F130E4B for ; Sat, 1 Dec 2018 11:52:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0DGPS9LWGWYs for ; Sat, 1 Dec 2018 11:52:56 -0800 (PST) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE68B130E46 for ; Sat, 1 Dec 2018 11:52:56 -0800 (PST) Received: by mail-qt1-x834.google.com with SMTP id k12so9691240qtf.7 for ; Sat, 01 Dec 2018 11:52:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=rML4Bj3bDFrCuvdEjagMY+VsQVcLGYshJtb/S7Sy0jA=; b=JRnDgOSiXkY6y+uap4XJRdQEM0kVd2hG6RyqeeghcXdaOtqm8VWIaPPvQ47BL/eUZB bgL9mDEfPKMIP9RkAYzLeKR385tivpWmuDR+OHtBWxF1fVdbAH1NUSOi9DMnWBX3vgoD YRllVqi8UqlL7A9tzgGsKiRtBsCFQg+5UkWQz1ECvzBXcGh/WgJn5724/KiA7zdW1g5y RuQGYWNDeJ7XbLao+IJCKuc1vi7S7fI/oFzigBlaA2H4S7XwWRIK90G++pP5LhdqhtZl EPSkHnVk7fpgBJKt5WDToTRdv0SxlYixjSyZNQdS5HFn4vritHqjWhento7LWpKBOVKG +6NA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=rML4Bj3bDFrCuvdEjagMY+VsQVcLGYshJtb/S7Sy0jA=; b=n1VUUu8vgnP28A2M4eYd6NWpvKy2FpiXXbjnyUfRhhWZRVlLZT5p2yw753AWn/wXtO N7OAJE67tdpTtNL9FHVJ0jjZalPqkT82Q2CFF4QfV6+JdQ8QcEz/oPrZwNhq9OegOH/B HkzMm6+7tmaGf+U2yuyYFag2EOaHI5x0ujY0wUFhq/2jARcPr+uZT23/33CmiNlsS0qn Vlx6jEEvx1pPsVrxTlJCtUrqkj3XTBV3w5grJU+GUwmsDLR7/i8N1mrTty5QSsi8SBds UtFfChfOlTteLD6wHAvUDzTOaDkPRRg8lWmvxJy8/+vv5xKRdYy4oJug11sW5o4iJuyz Szgg== X-Gm-Message-State: AA+aEWYOpUNEDmr3EJcu3MeSx9KLhDR6w1RQIMMQhiAJB1lJYVNRs8HA WS5T16b54EgOi2qLEqRR3qt5V+5rW3rCqnhcV20PnPKt X-Google-Smtp-Source: AFSGD/VLyDDhNMpCZ+niAtJTaXIvB9kGnulYTGELBS0guufOJr1iI1SlVVxDHMO/JXpWgliF4BSUOpRYbG3SZfiB60A= X-Received: by 2002:ac8:2e6a:: with SMTP id s39mr10299382qta.355.1543693975610; Sat, 01 Dec 2018 11:52:55 -0800 (PST) MIME-Version: 1.0 From: Dave Taht Date: Sat, 1 Dec 2018 11:52:43 -0800 Message-ID: To: babel-users , Babel at IETF Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: [babel] HMAC routerid->key mappings? X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Dec 2018 19:52:59 -0000 in reading over and attempting to deploy the hmac specification, I think the code, at least, currently misses an optimization, and perhaps the spec needs a tweak... as keys (currently) protect each interface, not each router association... It protects a single domain from (some) internal attacks. It protects a p2p interchange consider, instead a case where you are dropping a bunch of networks into an information interchange (call it "BIX"[1]), where a bunch of networks have agreed to interconnect, over a single "wire", much like how BGP network interchanges work today. Key exchange here, in the BGP world, is on a per-router, not per-interface, basis. Net A Net B Net C Net D Net E | | | | | ------------------------------------------ | | | | | F G H I J As per the spec: "When a node A receives a packet over an interface that requires cryptographic protection, it independently computes a set of HMACs and compares them to the HMACs appended to the packet; if there is no match, the packet is discarded." It is unwise to share one key with all interchangers. Co-ordinating a key rollover with that many different entities on that wire is hard. Using specific keys instead for each of the A-F, A-G, A-B, etc, associations limits the geometric growth and security vulnerabilities. A) while we can append quite a few HMACs in a hello, at some point, when an interchange's hmacs grows past the size of a packet, we run out of space. What happens? Can we resend that hello with even more HMAC's attached, and win? B) As an optimization, unicast transfers can just be hmac'd with the keys defined for that routerid association. So if the code (in addition to protecting interfaces) could also (or instead of interfaces) associate keys to routerids, we scale to this scenario. Alternatively we could just say: 1) Use BGP instead at large interchanges 2) Use DTLS 3) Use a minimal number for all associations on an interface scaled to the max size of hello + ihu + hmacs [1] I have fond memories of the original BIX from byte magazine --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 From nobody Sat Dec 1 12:11:24 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEE28130E35 for ; Sat, 1 Dec 2018 12:11:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PaB6D8X4t9-S for ; Sat, 1 Dec 2018 12:11:22 -0800 (PST) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9706B130DFE for ; Sat, 1 Dec 2018 12:11:22 -0800 (PST) Received: by mail-qt1-x834.google.com with SMTP id d19so9726189qtq.9 for ; Sat, 01 Dec 2018 12:11:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=hRvRzO64uiF5Sq6qff3D3M+BQ9vPhXBt0p0VDBFK/4M=; b=buEWiuBy2zo+QpO8xpQrZNhTzoWe6zAWkqGSonNTLkksLFTCdlZmoPwT/VnU7HX//K pDz2ACuNw2uNjJ+eg3O7suP7m6GpuAeP9lNnCslTyg/Retmt79Fi3/+zSnL8jltOPndf RpI7r8bkrLpEnT19THG2Yh2jVyRzhJ7FiV0M3TP8zueg28gh+vLgNj2VI+CmQrNoXrk+ FGvmduDkFkoNLiFnFhN9wuTth78ovpLDln1WT1U/9F81SIbSUSIfNfEh7oOLW9Sb6pXo wslja0Slr1MusgERs3DZQq2wSfo9INN4h1Mypf77duh17jadDtfGVkvXPR89PwCw+Wuz EKFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=hRvRzO64uiF5Sq6qff3D3M+BQ9vPhXBt0p0VDBFK/4M=; b=fViLmOi95dkqlY/hs3mv8hQ9LUOGPtdXEHboEj6AkH1BsEEREl5rWyeP/9bZJnHXuk yLaPW6+/G6mtDp9rKdgY8XPmlKw8sYooBym4XKnS3chyebx8of64f57G0IbmerWF/LZU BLVDRqzSMeGuKXAkOtkpuLwK7bfieUTW49pfF2xTMMmcrMWiUGHAPXRN2Jms2Vpf3D2J ccGhSLTbqcY62ws/rN/IPkQ8MfYJTpj+cT11QFfmS6VcmTW7ZcTaJBbyRMX5FT9J68+Y r2neiSo4xzsBS0I3M478aeI5XxyjhQ/HShsqEfeTeU1JaJp9jTnUate8yy2WO2T7zVnE pghw== X-Gm-Message-State: AA+aEWYrANEPcjhqVplpjoPSt+xGyTGKmSxMJmHF5uDO3ZtPkD6zGnsl 1npOTPCZjgplLd2ibAnPv+ptcpcy6I108Di8DT8= X-Google-Smtp-Source: AFSGD/WWU1I8fN34x+YwzT3rmCkKszwNjL7koHsI7n1bDD288w0cgxZIB/G8IDha0CZVi54mP6mcCqJZ46YG7wba6As= X-Received: by 2002:a0c:a402:: with SMTP id w2mr10548449qvw.129.1543695081651; Sat, 01 Dec 2018 12:11:21 -0800 (PST) MIME-Version: 1.0 From: Dave Taht Date: Sat, 1 Dec 2018 12:11:09 -0800 Message-ID: To: babel-users , Babel at IETF Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: [babel] BASE64 and hex encoding HMAC keys for user presentation X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Dec 2018 20:11:24 -0000 I would like the bird and babel implementations to allow for and use BASE64 and hex encodings. This allows for a shorter, more human friendly representation of both cryptographically generated keys and the keys humans are more likely to remember and type without error. In the latter case, guidelines as to length, mixed case and punctuation would be useful. There are only so many hexadecimal jokes that are easy to remember, deadbeef being the most common. Requiring that a hex key be prefixed with 0x and that keys otherwise shown users be in base64 would make for an easier deployment, and keys like Get0ffMyLawnBadGuys and NSAdeliveryVAN easier on the eyes than the equivalent: 0x19eb747df3322dac2705a746bb2b and 0x35201d7a58af7abc9500 and still allows for harder keys to be cryptographically generated by other tools, like IG/MmDjiVJW0+ojz32+4KDtVuGlJJKkhYEEEkpbwTkE=3D I do not off the top of my head know how much this compromises the dynamic range of a given key, but I would hope that being --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 From nobody Sat Dec 1 12:12:36 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1A48130E46 for ; Sat, 1 Dec 2018 12:12:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mhcQSLudA8ba for ; Sat, 1 Dec 2018 12:12:33 -0800 (PST) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C69F6130DFE for ; Sat, 1 Dec 2018 12:12:32 -0800 (PST) Received: by mail-qt1-x82e.google.com with SMTP id y20so9710085qtm.13 for ; Sat, 01 Dec 2018 12:12:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :content-transfer-encoding; bh=xYpEr8jiBshU1QxfEbglfsuo2D1ThgLXnB4mz+yzVCs=; b=LorkE1HJxbOa7xUB3OqYtPQcUQFqNjioXw+fs8aDx5cSXYKVZw8SQGm5yL5NVgZP++ CBDi2zSBVJIXHIQ+qB9bK1OhZ+iRveRWlvhGt9ob3ORw1q91/Ws4OH/UDLqMrU2YItgO vfLUEsEpZ2Be++aPL1UZy6MbuFlZBaTnGtf/8xwKOSoNPMzwgHFIcOH9NOKzz1X86VX7 Ozf/tFYhWk0YAWGxP9qiwqgUFrakcyyL/APG+3cApxJQ3X6nxtLa5H11x+T0HzK3S1n7 h5cR7HvfRPsIJOeMaA/g4F82A979bilV8q8ZBewPp0bkKbHqZfYDwylJ6rjbH7NzTavn gUPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:content-transfer-encoding; bh=xYpEr8jiBshU1QxfEbglfsuo2D1ThgLXnB4mz+yzVCs=; b=QFDwnZDci+UXR7FEdwqRUh9XNXMz3vmdwrbJzAd4Bg5bqLKpGViLoxDdB6o7ODBnVs wXhwSj8Yg2U7m4hL6nIUoUvOwOg7GhwESNl+qisvmtKf9dHRc/KVGNFC1w2CZSp8Bm1z oKORg3P7LtQd+qVeq2kKfqKvYYPsDb1R1LPGUzwYfg57AQwblW2zxn4baphWTwWVrg5Q cAwGhHwQP/cZWnyQ0h5y0iko0tVu8Z1f2s9xy6CsqwxHxQEn1RrcJeFu/H4LRBv6enpH H92BNXon0yfhytZYxa9k4jGndu3l+rn+T0TW/RNwW0RV4nqdcdAtIElBH8EDPuTfIq3f f2hA== X-Gm-Message-State: AA+aEWbwnZe4yabnJP3uq2giNmPlJ3doQIiWyttoK88CAiPGkLF1Mu5b 1vhs4DxnVhXJXWiYKMvfMA0hLFKfGjg3fxdJDj1PeQ== X-Google-Smtp-Source: AFSGD/WFLvrxrR0Rtxr5r1YkhVh4g8aE5/bckRuB76A+cfHGNlJL++6mX6TzZxNwU/hH7s/FVmbiTFyKlkX9ySdwhI8= X-Received: by 2002:ac8:2e6a:: with SMTP id s39mr10343389qta.355.1543695151859; Sat, 01 Dec 2018 12:12:31 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Dave Taht Date: Sat, 1 Dec 2018 12:12:19 -0800 Message-ID: To: babel-users , Babel at IETF Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [babel] BASE64 and hex encoding HMAC keys for user presentation X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Dec 2018 20:12:35 -0000 On Sat, Dec 1, 2018 at 12:11 PM Dave Taht wrote: > > I would like the bird and babel implementations to allow for and use > BASE64 and hex encodings. > > This allows for a shorter, more human friendly representation of both > cryptographically generated keys and the keys humans are more likely > to remember and type without error. In the latter case, guidelines as > to length, mixed case and punctuation would be useful. > > There are only so many hexadecimal jokes that are easy to remember, > deadbeef being the most common. Requiring that a hex key be prefixed > with 0x and that keys otherwise shown users > be in base64 would make for an easier deployment, and keys like > Get0ffMyLawnBadGuys and NSAdeliveryVAN easier on the eyes than the > equivalent: 0x19eb747df3322dac2705a746bb2b and 0x35201d7a58af7abc9500 > and still allows for harder keys to be cryptographically generated by > other tools, like IG/MmDjiVJW0+ojz32+4KDtVuGlJJKkhYEEEkpbwTkE=3D > > I do not off the top of my head know how much this compromises the > dynamic range of a given key, but I would hope that being easier on humans, it makes for an easier deployment. > > -- > > Dave T=C3=A4ht > CTO, TekLibre, LLC > http://www.teklibre.com > Tel: 1-831-205-9740 --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 From nobody Sat Dec 1 12:35:04 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47723130E5A for ; Sat, 1 Dec 2018 12:35:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YbjLQNDKjwSO for ; Sat, 1 Dec 2018 12:35:00 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50B4E130E55 for ; Sat, 1 Dec 2018 12:35:00 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wB1KYpvC006037 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 1 Dec 2018 21:34:52 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wB1KYrRp032767; Sat, 1 Dec 2018 21:34:53 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 385174EE2E; Sat, 1 Dec 2018 21:34:58 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id WDCik1FY3Re0; Sat, 1 Dec 2018 21:34:56 +0100 (CET) Received: from pirx.irif.fr (unknown [78.194.40.74]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 077484EE2C; Sat, 1 Dec 2018 21:34:56 +0100 (CET) Date: Sat, 01 Dec 2018 21:34:55 +0100 Message-ID: <87muppf0k0.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: babel-users , Babel at IETF In-Reply-To: References: User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sat, 01 Dec 2018 21:34:52 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sat, 01 Dec 2018 21:34:54 +0100 (CET) X-Miltered: at korolev with ID 5C02F06B.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C02F06D.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C02F06B.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C02F06D.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C02F06B.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C02F06D.000 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] HMAC routerid->key mappings? X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Dec 2018 20:35:02 -0000 > as keys (currently) protect each interface, not each router association... Correct. Babel uses both unicast and multicast, and Babel-HMAC is designed so that it can protect multicast traffic while remaining immune to replay, even in the absence of persistent state or hardware clocks. > consider, instead a case where you are dropping a bunch of networks > into an information interchange (call it "BIX"[1]), where a bunch of > networks have agreed to interconnect, over a single "wire", much like > how BGP network interchanges work today. Key exchange here, in the BGP > world, is on a per-router, not per-interface, basis. BGP is a unicast-only protocol, hence it can easily use per-peer keys. > It is unwise to share one key with all interchangers. Co-ordinating a > key rollover with that many different entities on that wire is hard. > Using specific keys instead for each of the A-F, A-G, A-B, etc, > associations limits the geometric growth and security vulnerabilities. The clean solution would be to use a bunch of point-to-point interfaces, either by replacing your switch with direct router-to-router links, or by putting up a bunch of VLANs or GRE tunnels. Then you can use Babel-HMAC unmodified. > A) while we can append quite a few HMACs in a hello, at some point, > when an interchange's hmacs grows past the size of a packet, we run > out of space. What happens? Can we resend that hello with even more > HMAC's attached, and win? Sort of. However, if there are any plaintext routers on the same link, they will parse both packets. I think that Babel should deal fairly well with packet duplication, but I'm not sure. But at that point, you might as well use DTLS. > So if the code (in addition to protecting interfaces) could also (or > instead of interfaces) associate keys to routerids, we scale to this > scenario. I'm not going to do that, unless there are any good reasons why you don't want to use DTLS in that case. > 1) Use BGP instead at large interchanges Yep. If your routing tables are relatively stable, BGP is the right choice. > 2) Use DTLS Yep. It supports per-peer keying out of the box. > 3) Use a minimal number for all associations on an interface scaled to > the max size of hello + ihu + hmacs Not so keen on that -- while the protocol does in principle support multiple HMACs, both the amount of overhead and the amount of computation go up linearly with the number of HMACs. It's really not designed for that. Of course, you could envision using the unicast variant of the protocol (the one that rejects all multicast packets except Hellos) and protect unicast packets with HMAC instead of DTLS. But at that point, you might just as well use DTLS. Quite frankly -- just use DTLS, or run HMAC over point-to-point links. -- Juliusz From nobody Sat Dec 1 15:11:06 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58A87130E62 for ; Sat, 1 Dec 2018 15:11:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IIBWGdlDBDqT for ; Sat, 1 Dec 2018 15:11:03 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A39D7130E67 for ; Sat, 1 Dec 2018 15:11:03 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1543705829; bh=xhrRCl4sgA2SHO6KSlCBhWN9yH3AJof+VGdXJQGrjH8=; h=From:To:Subject:In-Reply-To:References:Date:From; b=yCGw5hgv6UyLnLCZ1LO+DKbp4AclPfoOuPBeApwdrmE2ZFK6yXE7Oav+NDt327Zks gYGyyIHQG6PSD/LwfATi7TwBlWcJWscxN2SzPD6QqRx91E4T3QZzMaarLUI2i3W5Ke 38Dygqzt3IQrcMIQ6vcCOzPEPlWNykps+6eOIU9UDj4g4/1TUqAkmRUXy1DLZbSv4y edyYYGtpq62Egmz0+306HN003LJrPk9bmIcqzucJpAUeUtYx2oNWnwVuauZuCW9Jqx IGFaPmtQ41e1BFMYMDbzWOAaaMfBdm5NWEShexm68m5pvnkC86dnH3h7ru1hrcBBBl dsGP6mDLFIdxg== To: Dave Taht , babel-users , Babel at IETF In-Reply-To: References: Date: Sun, 02 Dec 2018 00:10:24 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87pnukkfmn.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] [Babel-users] BASE64 and hex encoding HMAC keys for user presentation X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Dec 2018 23:11:05 -0000 Dave Taht writes: > I would like the bird and babel implementations to allow for and use > BASE64 and hex encodings. In Bird's case, the password parsing code is part of the core; not going to special-case it for Babel. -Toke From nobody Sat Dec 1 16:42:50 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B74A8130E6B for ; Sat, 1 Dec 2018 16:42:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lqRIMNi4O7cI for ; Sat, 1 Dec 2018 16:42:46 -0800 (PST) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10BE9130E68 for ; Sat, 1 Dec 2018 16:42:46 -0800 (PST) Received: by mail-qt1-x835.google.com with SMTP id y20so10068437qtm.13 for ; Sat, 01 Dec 2018 16:42:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=HdxTJCj9H4GqResHgQmkA0D+Y2MRUSLuafNhxpZTCpw=; b=FvHwD4FqUV98IM1RL+6bmNaRTBottd89WbjdST0PAnXHta+nZtMOygzTiEVapSYLLx G/UVygcWOYH0se4Bn2Sg0jW5LrR4u9wMZs6NXjuQkHDaVaIExsW8/GXtZK0wNfjYBI9u StVP5kijgf8sw7giwX2v6A6WS7rtFVdmvbrksJ7ZpzjRpRQzPUpuvDo+rrY+bQv9Bvci 8mU284dzi70o/etW+ZMCuj75Nm1/XHqwbLQEPgjBx1vGWtIGaSeICbFU1h2EIEORQXwl tmAMs9Lp66jdftbAheG3dWa/I7Ds6KMIvKo5v+S3ocb2G9kLOW10h1mM3rAAHIARmrVj /9dQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=HdxTJCj9H4GqResHgQmkA0D+Y2MRUSLuafNhxpZTCpw=; b=eLIIXRR/+SzCjK8vjUdTsO5Y+k35kR26pDdK6ktRTEFgu8QZfmSrpVpg/DltnRWv+0 I26pQokFWuuy6JdpbYis/MSA3aIiWybpiYRgR9Y49shgVRshtMHk0oly0A5JtyojvdMw +0iWM72hGo144878MJDcUlyrHwsT88Zi/PG18IsijL//wIOHr2ukPZLGqJIg99WPcydT 88EkXQp6GeqUnU31RqIl9Niv5WotVbp86DKK5dqfhi8DhrIytv/yyjwwFgVqq6xF56EL qJpM0/y8vgmRLyB0j2Tk9u2RV3u+qNXnauo4wCGr/7C5gOMJrpErCdLkc3m/DcvTPEzj GXXQ== X-Gm-Message-State: AA+aEWagxbcFwHCZEBwy80Z9XR3ZwS3yB30mzC8qzMpKb27pULPnE0KB a8j9TvDQANiTI7CAg1xAAr7eoppd6w/e3ZoRF3c= X-Google-Smtp-Source: AFSGD/V39Ie+U6FnkOtyDL5P5x6m+Xw+xXsq625DtYqIEzfmdQWfzwnCQx6wBizwu9LJawKmHN24BB97UhaKu/iMPDk= X-Received: by 2002:ac8:5314:: with SMTP id t20mr10458199qtn.328.1543711365030; Sat, 01 Dec 2018 16:42:45 -0800 (PST) MIME-Version: 1.0 References: <87muppf0k0.wl-jch@irif.fr> In-Reply-To: <87muppf0k0.wl-jch@irif.fr> From: Dave Taht Date: Sat, 1 Dec 2018 16:42:32 -0800 Message-ID: To: Juliusz Chroboczek Cc: babel-users , Babel at IETF Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [babel] HMAC routerid->key mappings? X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 00:42:49 -0000 On Sat, Dec 1, 2018 at 12:34 PM Juliusz Chroboczek wrote: > > > as keys (currently) protect each interface, not each router association= ... > > Correct. Babel uses both unicast and multicast, and Babel-HMAC is > designed so that it can protect multicast traffic while remaining immune > to replay, even in the absence of persistent state or hardware clocks. > > > consider, instead a case where you are dropping a bunch of networks > > into an information interchange (call it "BIX"[1]), where a bunch of > > networks have agreed to interconnect, over a single "wire", much like > > how BGP network interchanges work today. Key exchange here, in the BGP > > world, is on a per-router, not per-interface, basis. > > BGP is a unicast-only protocol, hence it can easily use per-peer keys. > > > It is unwise to share one key with all interchangers. Co-ordinating a > > key rollover with that many different entities on that wire is hard. > > > Using specific keys instead for each of the A-F, A-G, A-B, etc, > > associations limits the geometric growth and security vulnerabilities. > > The clean solution would be to use a bunch of point-to-point interfaces, > either by replacing your switch with direct router-to-router links, or by Would be a rather big switch to replace, so, no, not in this model... > putting up a bunch of VLANs or GRE tunnels. Then you can use Babel-HMAC > unmodified. Well, an even cleaner solution for that wire would be to be using one veth per link (or in the case of vms, dockers, snaps, etc, the virtual interface they present), bridged to the wire, which is a common deployment model. A vm is often migrated between machines, and it would just pick up in one place and resume in another. Incidentally, "multiple vms bridged to a wire" was my mental model for setting up a bunch of vms to test interop, simulating various conditions. I have a standard veth model for simulating delay and multiple routers for the wifi work also (using namespaces). Anyway: The "one interface per key" rule adds complexity but I think it also brings benefits by requiring such. In such an environment you'd want to rate limit and observe how much bandwidth is being used for each interconnect anyway. Other stats and abstractions fall out of it. In the case of bridging veths like this, we'd still end up with mcast hellos hitting the wire, but using unicast then for everything else, and I'd judge hmacing and discarding those extra hellos as pretty cheap, although noisy in the log file. About the only issue I see for an interchange like this is that you'd also need one ipv4 address per veth, which are kind of scarce. unless there was a way to do the obscure extended nexthop idea in https://tools.ietf.org/rfc/rfc5549.txt in babel and linux? https://www.oreilly.com/library/view/bgp-in-the/9781491983416/ch04.html goes into it. It makes my brain hurt. > > > A) while we can append quite a few HMACs in a hello, at some point, > > when an interchange's hmacs grows past the size of a packet, we run > > out of space. What happens? Can we resend that hello with even more > > HMAC's attached, and win? > > Sort of. However, if there are any plaintext routers on the same link, > they will parse both packets. Definitely would not allow any plaintext routers on that wire. > I think that Babel should deal fairly well > with packet duplication, but I'm not sure. Yea! More things for me to try blowing up! Has anyone here ever futzed with a fuzzer, btw? This looks good: http://lcamtuf.coredump.cx/afl/ > But at that point, you might as well use DTLS. Heh. I would like hmac to stabilize first. > > > So if the code (in addition to protecting interfaces) could also (or > > instead of interfaces) associate keys to routerids, we scale to this > > scenario. > > I'm not going to do that, unless there are any good reasons why you don't > want to use DTLS in that case. Look forward to trying it. > > > 1) Use BGP instead at large interchanges > > Yep. If your routing tables are relatively stable, BGP is the right choi= ce. There are many, many, reasons to not want to use another routing protocol as complicated and difficult to use and configure as BGP in any scenario smaller than the global scale internet. There's also source specific routing, which I think is still problematic in any BGP protocol? I see ISIS in FRR has got it now. > > > 2) Use DTLS > > Yep. It supports per-peer keying out of the box. K. > > > 3) Use a minimal number for all associations on an interface scaled to > > the max size of hello + ihu + hmacs > > Not so keen on that -- while the protocol does in principle support > multiple HMACs, both the amount of overhead and the amount of computation > go up linearly with the number of HMACs. It's really not designed for th= at. The HMAC benchmarks were promising yesterday. (compared to DTLS!!!!???? ) I guess my mental model about key rollover was pretty different - where everyone was assuming at most 2 keys, I was assuming potentially many and key rollovers taking weeks. "dang, I really need to ask joe to retire that old key, and when does mary get back from vacation?" The optimization I had in mind was to enthusiastically sign hellos with every active key you have, but only sign unicast with the keys you know are working. > > Of course, you could envision using the unicast variant of the protocol > (the one that rejects all multicast packets except Hellos) and protect > unicast packets with HMAC instead of DTLS. That is what works, theoretically, right now, with the existing codebase. > But at that point, you might > just as well use DTLS. > > Quite frankly -- just use DTLS, or run HMAC over point-to-point links. > > -- Juliusz --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 From nobody Sat Dec 1 17:07:35 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD4E4130E6C for ; Sat, 1 Dec 2018 17:07:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZlJ-itDnr5gS for ; Sat, 1 Dec 2018 17:07:31 -0800 (PST) Received: from mail-qk1-x743.google.com (mail-qk1-x743.google.com [IPv6:2607:f8b0:4864:20::743]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7065129A87 for ; Sat, 1 Dec 2018 17:07:31 -0800 (PST) Received: by mail-qk1-x743.google.com with SMTP id q1so5396633qkf.13 for ; Sat, 01 Dec 2018 17:07:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=C0viAuY+vafvtZVcMni+bFDdZ1GwZzkfaCVK9q5aMCw=; b=dZXbU+xY9XVzxxDKmM8+nznZXcWdkmcwArvHo3tOthJhmAVE6B4qUOlJ//nQWnpZS2 ri58gBDdu1Ouox4S1HefB7x0GNuTjl6d0mRPAkSkKBs+XMYKfcuULmIoAPJOHppBitGd qHoO9DlzPaZBzQTOwEQiItHoABrBapXPglQhtjHPM2sMmS+XtsmEIU3GHPD712fdH8Za 9tiTXdIX0znphyejsk8lpEJHqbNstcEPE1Q4nLR1MLq8dWZWdZB8DuK2oIS5w8ZDVFZ9 jtuUHjpYDo4iNMSNybu+PO8xSREhjx3SU2ZJvE53eefs4zUp8mXQEk9b11OLxilhM2O7 vfmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=C0viAuY+vafvtZVcMni+bFDdZ1GwZzkfaCVK9q5aMCw=; b=RQTdpZzK89Lowq8nlH4drZ9V8oKlVhIL2Di3OYnzDsjvBB2kFAVdAPuo6mk5BLkaTF ie6RDA07UdpFBRND8R8I26NEfQFF23JZWXQhLTzfUEmFDGBXmEmUaZfjRax3YScHUtWn 3pevJJy+NWAvbAYvBDOBoZ/uaso8DmKFzqjAuwSJTmKhfZmYgB/D1v3ty3JfdparSHDz w4hTCZMk57gzVkV7iUZVKtguv0IWuMjMM8okmek40VNPvnSVP9w0q5eFsFfkuoJdLqEF nU3vazCOXFre75vU09TU68JlLOYqxum8pTbcAhc6RtfH1iAckYcv2cIakeC9T0jVZzD8 SnEA== X-Gm-Message-State: AA+aEWYM2b4n6AGBvmXvuUyeQkiXtd5mL7WlpMPJh9L4LxTtHpLb8Gai 6AbANuRs76dvLa3thcojERHmxfSINoiWWJ2H6b0= X-Google-Smtp-Source: AFSGD/VlpxmNAk46SGIJip7m9j1Ql4fKAZeCDqM16MSj5mPGBtoDaRXjcP1jUBF6bOhINBn/HbIegLXMV6SvNzv4sG8= X-Received: by 2002:a37:18d5:: with SMTP id 82mr10003206qky.65.1543712850637; Sat, 01 Dec 2018 17:07:30 -0800 (PST) MIME-Version: 1.0 References: <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <871s78x7z0.fsf@toke.dk> <2D09D61DDFA73D4C884805CC7865E6114DF44154@GAALPA1MSGUSRBF.ITServices.sbc.com> <87pnurwo5e.fsf@toke.dk> <87o9a9v3c6.fsf@toke.dk> <875zwhxv28.wl-jch@irif.fr> <8736rl16yj.fsf@taht.net> <87lg5cxuql.fsf@taht.net> <1C6B19AE-EAA7-4329-A364-8E4C059DAC01@iki.fi> <87woouq24j.fsf@toke.dk> <87in0e6c6v.wl-jch@irif.fr> <87o9a6pumz.fsf@toke.dk> In-Reply-To: <87o9a6pumz.fsf@toke.dk> From: Dave Taht Date: Sat, 1 Dec 2018 17:07:18 -0800 Message-ID: To: =?UTF-8?B?VG9rZSBIw7hpbGFuZC1Kw7hyZ2Vuc2Vu?= Cc: Juliusz Chroboczek , Markus Stenberg , Babel at IETF , babel-users Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [babel] [Babel-users] Blake2S, blake2B or neither? [was: rather than ripemd160...] X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 01:07:34 -0000 On Fri, Nov 30, 2018 at 5:23 AM Toke H=C3=B8iland-J=C3=B8rgensen wrote: > > Juliusz Chroboczek writes: > > >>> With these numbers, I withdraw my support of including anything else > >>> than SHA256 as MTI. I think specifying Blake2B or 2S as well makes > >>> sense (mostly for crypto robustness reasons for having alternative > >>> that is specified) but making it MAY-SHOULD seems sensible to me. > > > >> I can probably live with that :) > > > > Excellent, it looks like we're converging. Thanks to both of you for t= he > > informative and kind discussion. > > > > At this stage, I see four possibilities: > > > > (1) leave the document as it is; > > (2) add a mention that implementation of Blake2S is RECOMMENDED (SHOU= LD); > > (3) add a mention that implementation of Blake2B is RECOMMENDED; > > (4) add a mention that implementation of both 2B and 2S is RECOMMENDE= D. > > > > I am in favour of (1), since I am convinced that SHA256 is fast enough = for > > all reasonable devices. (2) makes sense to me, and I won't oppose it. > > I'll need some convincing in order to do (3) or (4), since Blake2B does > > not appear bring any significant speed advantage over SHA256. > > I'm in favour of (2). 2 is fine. Would still prefer MUST. Would also like an arm32 + neon blake benchmark. > > > In either case, I'm planning to implement SHA256, Blake2B and Blake2S i= n > > the reference implementation. > > Cool. I'll do the same in Bird, then :) > > -Toke > > _______________________________________________ > Babel-users mailing list > Babel-users@alioth-lists.debian.net > https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/babel-users --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 From nobody Sat Dec 1 17:52:23 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED14B12958B for ; Sat, 1 Dec 2018 17:52:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QKUauo6OCVaV for ; Sat, 1 Dec 2018 17:52:18 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D629128D68 for ; Sat, 1 Dec 2018 17:52:18 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wB21q9iW032074 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 2 Dec 2018 02:52:09 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wB21qBsQ027092; Sun, 2 Dec 2018 02:52:11 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id D0AB668F55; Sun, 2 Dec 2018 02:52:15 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id Ctfa2Vy3KQig; Sun, 2 Dec 2018 02:52:13 +0100 (CET) Received: from pirx.irif.fr (unknown [78.194.40.74]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 08B9668F50; Sun, 2 Dec 2018 02:52:13 +0100 (CET) Date: Sun, 02 Dec 2018 02:52:12 +0100 Message-ID: <87in0cg0fn.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: babel-users , Babel at IETF In-Reply-To: References: <87muppf0k0.wl-jch@irif.fr> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sun, 02 Dec 2018 02:52:09 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sun, 02 Dec 2018 02:52:11 +0100 (CET) X-Miltered: at korolev with ID 5C033AC9.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C033ACB.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C033AC9.001 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C033ACB.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C033AC9.001 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C033ACB.000 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] HMAC routerid->key mappings? X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 01:52:21 -0000 > The "one interface per key" rule adds complexity but I think it also > brings benefits by requiring such. It's conceptually elegant and easy to explain. These are good features to have. > About the only issue I see for an interchange like this is that you'd > also need one ipv4 address per veth, which are kind of scarce. > unless there was a way to do the obscure extended nexthop idea in > https://tools.ietf.org/rfc/rfc5549.txt in babel and linux? Babel (at least babeld, don't know about BIRD) should deal fine with Linux-style unnumbered links (which are different from Cisco-style unnumbered links). In the Linux style, you put the same IPv4 address on multiple links: ip addr add 192.0.2.1/32 dev eth0 ip addr add 192.0.2.1/32 dev eth1 ip addr add 192.0.2.1/32 dev wlan0 Now you run babeld on all interfaces, and everything should just work -- look, Ma, just one IPv4 address per host. (In Cisco style, you put your IPv4 address on the loopback interface, and the other interfaces magically borrow the loopback's IPv4 address. I find the Linux style easier to comprehend, but perhaps that's just me.) -- Juliusz From nobody Sun Dec 2 14:19:12 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86D37130DC8 for ; Sun, 2 Dec 2018 14:19:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HC22fOk2PNJy for ; Sun, 2 Dec 2018 14:19:09 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D6AB130DC7 for ; Sun, 2 Dec 2018 14:19:08 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wB2MIrKN022450 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 2 Dec 2018 23:18:53 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wB2MIorY022314; Sun, 2 Dec 2018 23:18:51 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id E3D1374110; Sun, 2 Dec 2018 23:18:54 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id jPfY0-gbcBEW; Sun, 2 Dec 2018 23:18:52 +0100 (CET) Received: from pirx.irif.fr (unknown [78.194.40.74]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 524D47410E; Sun, 2 Dec 2018 23:18:45 +0100 (CET) Date: Sun, 02 Dec 2018 23:18:45 +0100 Message-ID: <877egr1sje.wl-jch@irif.fr> From: Juliusz Chroboczek To: Ted Lemon Cc: Dave =?ISO-8859-1?Q?T=E4ht?= , Babel at IETF , keyur@arrcus.com, babel-users@lists.alioth.debian.org, Mahesh Jethanandani , bew@cisco.com In-Reply-To: References: <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <871s78x7z0.fsf@toke.dk> <87tvk0xvf4.fsf@taht.net> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sun, 02 Dec 2018 23:18:54 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sun, 02 Dec 2018 23:18:55 +0100 (CET) X-Miltered: at korolev with ID 5C045A4D.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C045A4A.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C045A4D.001 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C045A4A.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C045A4D.001 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C045A4A.000 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] [Babel-users] HMAC Key rotation key format (was ripemd) X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 22:19:11 -0000 > FWIW, for homenet the thought was to use HNCP to distribute keys amongst > routers. HNCP is not a good choice for symmetric key distribution, since it floods all information across the HNCP domain. It's impossible to use HNCP to distribute a key to some routers only while keeping it secret from others. -- Juliusz From nobody Sun Dec 2 14:19:59 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26FB8130DC7 for ; Sun, 2 Dec 2018 14:19:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id km-OLH6xcgC7 for ; Sun, 2 Dec 2018 14:19:57 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBC0B124D68 for ; Sun, 2 Dec 2018 14:19:56 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wB2MJk0n022794; Sun, 2 Dec 2018 23:19:46 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 2EC41741BB; Sun, 2 Dec 2018 23:19:53 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id LWX9Vn4wYMD4; Sun, 2 Dec 2018 23:19:51 +0100 (CET) Received: from pirx.irif.fr (unknown [78.194.40.74]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id E62967417D; Sun, 2 Dec 2018 23:19:46 +0100 (CET) Date: Sun, 02 Dec 2018 23:19:46 +0100 Message-ID: <875zwb1shp.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: Toke =?ISO-8859-1?Q?H=F8iland-J=F8rgensen?= , babel-users , Babel at IETF In-Reply-To: References: <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <871s78x7z0.fsf@toke.dk> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sun, 02 Dec 2018 23:19:48 +0100 (CET) X-Miltered: at korolev with ID 5C045A82.002 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C045A82.002 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C045A82.002 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] HMAC Key rotation key format (was ripemd) X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 22:19:58 -0000 > Setting that aside for the moment, having a standardized file format > for babel keys would be a boon and boost interoperability between > bird/babel and other possible implementations. Have you looked at RFC 7210? -- Juliusz From nobody Tue Dec 4 09:48:52 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31F63130FAB for ; Tue, 4 Dec 2018 09:48:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a7n5JW5WRLCB for ; Tue, 4 Dec 2018 09:48:48 -0800 (PST) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F7C4130E44 for ; Tue, 4 Dec 2018 09:48:48 -0800 (PST) Received: by mail-qk1-x729.google.com with SMTP id w204so10146735qka.2 for ; Tue, 04 Dec 2018 09:48:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=tB5J1TNVautb8lrJdws8ZxtVIXJ9njplddCgke1sKCw=; b=M98+BIzFf7EXA3uuAUxsc+Hp69OU7rsN8St0MjxWZjURY90h0k+cR8ezyldod7mKVX MRi7g/MiigwtZHbuX2lfIYgBQcObgf6HSj+2tBIkPtQ1JNupSSRp69H0fl8+sIwUko7Q kgd98SdB8Y1sNXSpIwSvcZBMftfKP2CGv1X/CV5WEYzj5dCxzeWz5FbJxh153cCPiD7p Q5WkF6rnycsvEKsCqqAwZgjAl65TfXXXJNYx+4h2IK4UA2Z5HUpJ0zj/IeW2WrfjpjpQ QZTbQziWBuTtLhxvrWVh5uMN1zid/A3+mcHzjMq71A5gueEYOnd2D/sgpnQDpeFhFWzA 80xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=tB5J1TNVautb8lrJdws8ZxtVIXJ9njplddCgke1sKCw=; b=Hq2csN8XQd1kon43FXp7gegdpquD7RnjFYMRzhun7eRSZqCr2d7gJk2fXE8AcQyHr4 ltshLusUtGB3A5T7z1Ruwlgh/2c4MJJuqGesCa231rKwrZDq+LY5SaOyFoKfXwj9Hz1r wUoGn0E+2VCT86QZxMb+j8hdJdVLxntoL7zse3LbdD/nuNcGfnwNaigEzlNunHqgHfXR CDzlh0pmLCvPAu55d/+iVt6YPoy1OIPpCjgpC3CRAVj6f5GPJHeS1UFsz8HMnJdKmCg+ QrAJk8TAmuFhpSgNSNivBlI5I1UUkBUmOi7pD/m4Y//MeJ6d9KpF3aNxpCTCqHC2yfiD nTYQ== X-Gm-Message-State: AA+aEWbie7shFce9jtimuBkhCpWEmLbiSfECaVoVZTbi5lJvaoQmofWH qldgO1VUChQwKczgYTPdAEP0eLaXQBqVhxCJdlA= X-Google-Smtp-Source: AFSGD/XVyEe4PfFqmV5JBsD+c5NhZA8k6077I50rrKKfurKU4z4YE15HWSzCTZQQX8ZZZ+BLKS2etRDcZ4w9LEyalY0= X-Received: by 2002:a37:18d5:: with SMTP id 82mr18970763qky.65.1543945727339; Tue, 04 Dec 2018 09:48:47 -0800 (PST) MIME-Version: 1.0 References: <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <871s78x7z0.fsf@toke.dk> <875zwb1shp.wl-jch@irif.fr> In-Reply-To: <875zwb1shp.wl-jch@irif.fr> From: Dave Taht Date: Tue, 4 Dec 2018 09:48:34 -0800 Message-ID: To: Juliusz Chroboczek Cc: =?UTF-8?B?VG9rZSBIw7hpbGFuZC1Kw7hyZ2Vuc2Vu?= , babel-users , Babel at IETF Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [babel] HMAC Key rotation key format (was ripemd) X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Dec 2018 17:48:51 -0000 On Sun, Dec 2, 2018 at 2:19 PM Juliusz Chroboczek wrote: > > > Setting that aside for the moment, having a standardized file format > > for babel keys would be a boon and boost interoperability between > > bird/babel and other possible implementations. > > Have you looked at RFC 7210? > > -- Juliusz https://xkcd.com/927/ It is evident (now!) that my conception of these conceptions was different than the homenet starting point. I envisioned lots and lots of keys interconnecting a multitude of networks, where the design as stands is oriented towards securing a single domain. further, I've learned now, dtls would be a better interconnect, and considering how to do that well might factor in the above standard. I would still rather like to be able to test key rollover by christmas! --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 From nobody Tue Dec 4 10:33:52 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EEAF130F29 for ; Tue, 4 Dec 2018 10:33:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kapsi.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vMJUQIMZIBNd for ; Tue, 4 Dec 2018 10:33:47 -0800 (PST) Received: from mail.kapsi.fi (mail.kapsi.fi [IPv6:2001:67c:1be8::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A35C7130ED9 for ; Tue, 4 Dec 2018 10:33:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=kapsi.fi; s=20161220; h=To:References:Message-Id:Content-Transfer-Encoding:Cc:Date: In-Reply-To:From:Subject:Mime-Version:Content-Type:Sender:Reply-To:Content-ID :Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To: Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe :List-Post:List-Owner:List-Archive; bh=HnrSqaSPSuRlh1bSlA/uEZy5Nl6wJIlNOiJK8vVUIvc=; b=szU7tDUjQpXC0nmZYJeOg84Pqk fWD/uTFBL8P4wnJOCKIIpbmb47CbD5PkKJ1JktdnSwAKUTGyaw6D+9aDNX0IjcXqs1Ibd1ucJpxF+ MshpLMvBRjl097+a8S5LrNxJeVXkBA0BZahlZBjSGPcr2XmVv7sa3a35dLp8y76sX1yQCl0/lvo1e fIVTl8fsPS6fTR+hF4SIZyvhvhUmw545kb81Naq0OC/UGxmKqlWlV1TqNg5H8Z5FqnNwEs6CoqaPW 9HekGdMJ8nco5TdmTIAS/KAHkAohA963mnOIf5sfL/3zUij9vB1N8nXDubXqnEmpJzlBtaU8DSf3t /yVGx36w==; Received: from 91-155-69-202.elisa-laajakaista.fi ([91.155.69.202] helo=[192.168.42.208]) by mail.kapsi.fi with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1gUFVs-0004Zu-AW; Tue, 04 Dec 2018 20:33:40 +0200 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) From: Markus Stenberg In-Reply-To: Date: Tue, 4 Dec 2018 20:33:39 +0200 Cc: Juliusz Chroboczek , =?utf-8?Q?Toke_H=C3=B8iland-J=C3=B8rgensen?= , babel-users , Babel at IETF Content-Transfer-Encoding: quoted-printable Message-Id: <7385DF08-E010-442A-83B6-1A5E9ECF67BC@iki.fi> References: <87in0koun6.wl-jch@irif.fr> <87in0kx98o.fsf@toke.dk> <871s78x7z0.fsf@toke.dk> <875zwb1shp.wl-jch@irif.fr> To: Dave Taht X-Mailer: Apple Mail (2.3445.101.1) X-SA-Exim-Connect-IP: 91.155.69.202 X-SA-Exim-Mail-From: markus.stenberg@iki.fi X-SA-Exim-Scanned: No (on mail.kapsi.fi); SAEximRunCond expanded to false Archived-At: Subject: Re: [babel] HMAC Key rotation key format (was ripemd) X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Dec 2018 18:33:50 -0000 For interconnected domains and whatever, I would rather just use DTLS = with relatively shortlived and auto-renewed certs (real-time revocation = is hard to do if you are authenticating routing - chicken 'n' egg = problem; one alternative is of course some sort of manual blacklisting = if you want to go with long-lived certs). =20 If HNCP is in picture, DNCP trust based consensus model is also an = option - with it, (self-signed) certificates can have long lifetime as = their usefulness is determined by consensus of nodes -> as long as = there's only few compromised nodes, you can blacklist them in real time = if you control the rest of the nodes. Cheers, -Markus From nobody Fri Dec 14 08:51:41 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6DF313115A for ; Fri, 14 Dec 2018 08:51:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pqZ3XYJJDBwa for ; Fri, 14 Dec 2018 08:51:37 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BF65131124 for ; Fri, 14 Dec 2018 08:51:35 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBEGpRXm030097 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 14 Dec 2018 17:51:28 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wBEGpTso027995; Fri, 14 Dec 2018 17:51:29 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id AB2BF254B8; Fri, 14 Dec 2018 17:51:33 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id x98g9RCxdu-x; Fri, 14 Dec 2018 17:51:31 +0100 (CET) Received: from lanthane.irif.fr (unknown [172.23.36.89]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id B353A254B5; Fri, 14 Dec 2018 17:51:31 +0100 (CET) Date: Fri, 14 Dec 2018 17:51:31 +0100 Message-ID: <875zvw127g.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: babel@ietf.org, babel-users@lists.alioth.debian.org In-Reply-To: <87in0h1ppd.fsf@taht.net> References: <87in0h1ppd.fsf@taht.net> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Fri, 14 Dec 2018 17:51:28 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Fri, 14 Dec 2018 17:51:29 +0100 (CET) X-Miltered: at korolev with ID 5C13DF8F.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C13DF91.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C13DF8F.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C13DF91.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C13DF8F.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C13DF91.000 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] [Babel-users] key rotation take #2 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2018 16:51:40 -0000 > This is the present babel conf file format: > key id key1 type sha1 value deadbeefdeadbeefdeadbeefdeadbeefdeadbeef > key id key2 type sha1 value dea2f0d01a57b0071057a11da7adeadbeeffffff > interface enp7s0 unicast false hmac key1 > interface wg1 hmac key2 Right. It currently cannot be updated dynamically, but the plan is that it will at some point before HMAC get merged into mainline. > so we invent a new keyword "serial". > a key rollover is initiated by adding a new key with the same name and a > larger serial number than the old one. I don't understand what problem you're trying to solve. You're happily HMACing your packets: key id key1 type sha1 value ... interface wlan0 hmac key1 At some point, you decide to start using a new key: key id key2 type sha1 value ... interface wlan0 hmac key1 hmac key2 You deploy the new key on all routers, then you delete the old key: interface wlan0 hmac key2 Why do you need a serial number? -- Juliusz From nobody Tue Dec 18 18:09:15 2018 Return-Path: X-Original-To: babel@ietf.org Delivered-To: babel@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 74F0F1276D0; Tue, 18 Dec 2018 18:09:08 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: babel@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.89.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: babel@ietf.org Message-ID: <154518534844.5131.1737110158790965878@ietfa.amsl.com> Date: Tue, 18 Dec 2018 18:09:08 -0800 Archived-At: Subject: [babel] I-D Action: draft-ietf-babel-yang-model-00.txt X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 02:09:08 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Babel routing protocol WG of the IETF. Title : YANG Data Model for Babel Authors : Mahesh Jethanandani Barbara Stark Filename : draft-ietf-babel-yang-model-00.txt Pages : 24 Date : 2018-12-18 Abstract: This document defines a data model for the Babel routing protocol. The data model is defined using the YANG data modeling language. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-babel-yang-model/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-babel-yang-model-00 https://datatracker.ietf.org/doc/html/draft-ietf-babel-yang-model-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Dec 19 11:24:53 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 535E7130EBC for ; Wed, 19 Dec 2018 11:24:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vBZAVOWx3bA6 for ; Wed, 19 Dec 2018 11:24:49 -0800 (PST) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD391130EF9 for ; Wed, 19 Dec 2018 11:24:48 -0800 (PST) Received: from pps.filterd (m0048589.ppops.net [127.0.0.1]) by m0048589.ppops.net-00191d01. (8.16.0.22/8.16.0.22) with SMTP id wBJIRKL5046255 for ; Wed, 19 Dec 2018 13:39:06 -0500 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0048589.ppops.net-00191d01. with ESMTP id 2pftfxhv7j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 19 Dec 2018 13:39:06 -0500 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id wBJId5vR022457 for ; Wed, 19 Dec 2018 13:39:05 -0500 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [135.47.91.176]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id wBJIcuEA022210 for ; Wed, 19 Dec 2018 13:39:00 -0500 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [127.0.0.1]) by zlp30487.vci.att.com (Service) with ESMTP id 82F774014069 for ; Wed, 19 Dec 2018 18:38:56 +0000 (GMT) Received: from GAALPA1MSGHUBAF.ITServices.sbc.com (unknown [130.8.218.155]) by zlp30487.vci.att.com (Service) with ESMTPS id 738114014043 for ; Wed, 19 Dec 2018 18:38:56 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.213]) by GAALPA1MSGHUBAF.ITServices.sbc.com ([130.8.218.155]) with mapi id 14.03.0415.000; Wed, 19 Dec 2018 13:38:56 -0500 From: "STARK, BARBARA H" To: Babel at IETF Thread-Topic: info-model: message log Thread-Index: AdSXyYnBQkQrNQ5OTYeO5Bd7aNbDmQ== Date: Wed, 19 Dec 2018 18:38:55 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114DF65C81@GAALPA1MSGUSRBF.ITServices.sbc.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.233.86] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-12-19_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=519 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1812190147 Archived-At: Subject: [babel] info-model: message log X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 19:24:52 -0000 Hi Babelers, I've been working on the info model again. Here is my suggestion for having a message log: babel-message-log is: A reference or url link to a file that contains a timestamped log of messag= es received and sent on babel-udp-port on all interfaces. File format MUST = be readable by Wireshark 1.8 or later and use the applicable file format ex= tension in the filename. Logging is enabled / disabled by babel-message-log= -enable. Would this work? Barbara From nobody Wed Dec 19 14:02:44 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD914130EDA for ; Wed, 19 Dec 2018 14:02:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R-XRNYB66EDY for ; Wed, 19 Dec 2018 14:02:40 -0800 (PST) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA6AC130EAE for ; Wed, 19 Dec 2018 14:02:40 -0800 (PST) Received: by mail-io1-xd2f.google.com with SMTP id r200so16813855iod.11 for ; Wed, 19 Dec 2018 14:02:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=69Wo63plq5OAGLqvKrZSAqdqKGEukqknisuC8KOdTDA=; b=i5hc60q12BW4RFixoG3ZFRhjbDaWw8v2rBvvQJx5hAlDYoluhR3LATcRwimFhpxzh3 t72VgX/BRhmvISVKXFnGNmpUkUDBCysH8lAWFtEWLS15ZPa98RIE3N86tJRurfY2Zum/ 8f/0Ba13aJOHvDjRDVZ2ttsKZO9jFLA1Z+bLuePWk6frdYBLKHAzQdSgkGqkCeTYk+vf nmBLvoVlB8WjD73f2BZx/kbMzVIBcAXu73zPjKWVntAUvc/zqYPKjDejtG8wI7oW8CP9 c3mfHi/8yGk+ZLPFhRxx5FwN0CmPn7ItSJBh8YVWtDfq7eNnZN21uHt1+ExziV0Jb4zJ JqIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=69Wo63plq5OAGLqvKrZSAqdqKGEukqknisuC8KOdTDA=; b=ojC1i60pPIv4RGc0vzug/pKX2BnE0obZvI95CHPgV0ipVtm9tOOZvNsmCG6zgt3yjz A+fKK6w3SIP0CWcOd8KnRQ3lxzpZfLwMP28hS3flzZ2vSkVJhfhVK7C0NshkNkdd0oWg bZ/hwoZR2pohKM46MTQ9kXi/lyqK0hABSEN/pvvX9EQpwWRp5UP5Je8UrTlVAVVeuOgx +rd9LHNrRPyCA2FcfFAjnbfYMxZmbM9UTIQrTHRLIivu/RAZOfoFBrNfi0LCmAYvYQSq x7oVTVaUiJ46A9ixhy/3Rx0mJIN3jQHpwtA+jkq8+w0pvP/Z/q0ZDrQaCTUrDAPLsAQ5 S+PA== X-Gm-Message-State: AA+aEWY3cmU0T1IvmiGxrnrTLaAimq3X6YDcoKPkXyMSqH9X8XnL7w8T o4/pXFwp3RbBNqxP5k+akJCUmSUsrw5RK7lj6yy+jQ== X-Google-Smtp-Source: AFSGD/Whv9ItYhF/z09Y73qGB6kZS9tzOo/1A+GvXi7a8XuwesMI8jLCL3m0o5Vj7O6BfbEfBazeO9lVMeVnehsRCbY= X-Received: by 2002:a6b:e919:: with SMTP id u25mr19815883iof.132.1545256959661; Wed, 19 Dec 2018 14:02:39 -0800 (PST) MIME-Version: 1.0 References: <87d0rfvn09.fsf@toke.dk> <2CE52AB2-C5CA-4D66-914A-0FB30A31F385@gmail.com> In-Reply-To: From: Donald Eastlake Date: Wed, 19 Dec 2018 17:02:28 -0500 Message-ID: To: Babel at IETF Content-Type: multipart/alternative; boundary="0000000000002ad9fc057d672ca2" Archived-At: Subject: [babel] Fwd: Poll for WG adoption of draft-mahesh-babel-yang-model X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2018 22:02:43 -0000 --0000000000002ad9fc057d672ca2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sorry, this should have been cc'ed to the WG mailing list. Thanks, Donald =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D Donald E. Eastlake 3rd +1-508-333-2270 (cell) 1424 Pro Shop Court, Davenport, FL 33896 USA d3e3e3@gmail.com ---------- Forwarded message --------- From: Donald Eastlake Date: Tue, Dec 18, 2018 at 10:44 AM Subject: Re: [babel] Poll for WG adoption of draft-mahesh-babel-yang-model To: Mahesh Jethanandani Cc: babel-chairs , STARK, BARBARA H Hi Mahesh, Yes, there is WG consensus to adopt the draft. Please post a draft-ietf-babel-yang-model-00 Sorry to have been a bit non-responsive recently. We'll try to catch up on Babel stuff this week. Thanks, Donald =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D Donald E. Eastlake 3rd +1-508-333-2270 (cell) 1424 Pro Shop Court, Davenport, FL 33896 USA d3e3e3@gmail.com On Mon, Dec 17, 2018 at 6:06 PM Mahesh Jethanandani wrote: > Hi Chairs, > > What is the update on this adoption call? Would you say there was adequat= e > support for its adoption? Should I posting the draft as a WG document? > > I need to also post an update to the draft, where I update the model base= d > on the feedback received at IETF in Bangkok, and add Barbara as a co-auth= or > on the draft. I can make the updates to the WG document, or post another > individual I-D. Please advise. > > Thanks. > > > On Nov 8, 2018, at 3:15 AM, Toke H=C3=B8iland-J=C3=B8rgensen wrote: > > > > Donald Eastlake writes: > > > >> This message begins a poll for BABEL WG adoption of > >> draft-mahesh-babel-yang-model-00 running through November 26th. Pleas= e > >> indicate whether you think this draft should be adopted as a starting > >> point. Comments on the draft are also welcome. > > > > I support adoption. > > > > -Toke > > > > _______________________________________________ > > babel mailing list > > babel@ietf.org > > https://www.ietf.org/mailman/listinfo/babel > > Mahesh Jethanandani > mjethanandani@gmail.com > > > > --0000000000002ad9fc057d672ca2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Sorry, this should have been cc'ed to the WG mailing l= ist.

Thanks,
Donald
=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=C2=A0Donald E. Eastlake 3rd =C2=A0 +1-508-333-2270 (cell)
=C2=A0142= 4 Pro Shop Court, Davenport, FL 33896 USA
=C2=A0d3e3e3@gmail.com


---------- Forwarded message -------= --
From: Donald Eastlake= <d3e3e3@= gmail.com>
Date: Tue, Dec 18, 2018 at 10:44 AM
Subject:= Re: [babel] Poll for WG adoption of draft-mahesh-babel-yang-model
To: M= ahesh Jethanandani <mjethanan= dani@gmail.com>
Cc: babel-chairs <babel-chairs@ietf.org>, STARK, BARBARA H <bs7652@att.com>


Hi Mahesh,

Yes, there is WG consensus to adopt the= draft.=C2=A0

Please post a draft-ietf-babel-yang-= model-00

Sorry to have been a bit non-responsive r= ecently. We'll try to catch up on Babel stuff this week.
=
Thanks,
Donald
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D
=C2=A0Donald E. Eastlake 3rd =C2=A0 +1-508-333-2270 (cell)
=C2=A0= 1424 Pro Shop Court, Davenport, FL 33896 USA
=C2=A0d3e3e3@gmail.com

=

On Mon, Dec 17,= 2018 at 6:06 PM Mahesh Jethanandani <mjethanandani@gmail.com> wrote:
=
Hi Chairs,

What is the update on this adoption call? Would you say there was adequate = support for its adoption? Should I posting the draft as a WG document?

I need to also post an update to the draft, where I update the model based = on the feedback received at IETF in Bangkok, and add Barbara as a co-author= on the draft. I can make the updates to the WG document, or post another i= ndividual I-D. Please advise.

Thanks.

> On Nov 8, 2018, at 3:15 AM, Toke H=C3=B8iland-J=C3=B8rgensen <toke@toke.dk> wrote: >
> Donald Eastlake <d3e3e3@gmail.com> writes:
>
>> This message begins a poll for BABEL WG adoption of
>> draft-mahesh-babel-yang-model-00 running through November=C2=A0 26= th. Please
>> indicate whether you think this draft should be adopted as a start= ing
>> point. Comments on the draft are also welcome.
>
> I support adoption.
>
> -Toke
>
> _______________________________________________
> babel mailing list
> babel@ietf.org=
> https://www.ietf.org/mailman/listinfo/babel

Mahesh Jethanandani
mjethanandani@= gmail.com



--0000000000002ad9fc057d672ca2-- From nobody Thu Dec 20 20:50:10 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26EAE130DD9; Thu, 20 Dec 2018 20:50:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w4pPyN5lZ1wN; Thu, 20 Dec 2018 20:50:07 -0800 (PST) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C862012D4E6; Thu, 20 Dec 2018 20:50:07 -0800 (PST) Received: by mail-io1-xd2e.google.com with SMTP id x6so2656850ioa.9; Thu, 20 Dec 2018 20:50:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=2qSBIM0nYYSPI00hMUwXmtTDyJTDUA/BckiD6xHgj2g=; b=pHCUwskQXuwcTjQfVKZXx6RLIXxyyiYiCyLYD+86vtxtwbxqTUb9r2SL8PG1k9TgWI HNzaU1q17F1M3uPtR7FdtBk5t4VBreryfaCwSFDlUBimw8N78dGJUn17n5taxrQCJpQ7 zjgs3ShuEnPyy++4VCGJldgbG4GOd8WIhUc11Dr/v9YphOdOdggWitkdBPDZpaCgmY/m /H1uYAIkKLG0WZ4Fwu4VVcwIGwQBJ7dmFwowmOVAt4w2XvyL6ii0VCT2P3k5GbJXLWF7 0Q5MyK5LIj41lDrAY48kr0/8v1DUTjf8XAp5e/FQoEocYEjFjvcfA4pLdEb50FuY/EDr uFww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=2qSBIM0nYYSPI00hMUwXmtTDyJTDUA/BckiD6xHgj2g=; b=OSIc11sKf6YOEu9WpZtQxOSC+49R5rzPQM713LV8PZDU3mkozro9cFEh9LgAJaoWdm siBqQh87093IlTNYFSlev9nQoVxsx6bAUE0BkTBOovXgNHc7WxbSpSKqJHi47yZiN+h+ ExUAtXo2rEfFFa2QDnQZlDVzr8tYZhT6kCvE9MSFvNf5ablDy32iJVYZp6TPYaGWFLGb Yy7+7w3E8H7rDPLC0hBayeNC9tM98QsxWmfvgj5lPIX/PluuNqEjbrfUZFALSh67tmRv nlHxg++tWbyGuw6IUE6DMWVOffVau8VlXrKzjX3ECiU+tbPVDHtD37CgHzanknaXYs/a h0CA== X-Gm-Message-State: AJcUukcWOfxsMRwFrqVHUzcOLl39INrqtx4Tn/u8tH1169J3ZSpG5wYr wjP6D2KAOfNsMXx7VgnrTTTgkW0OSzwnEproXPwopg== X-Google-Smtp-Source: ALg8bN6wxx2ac0MDFjcD8zdMEb4Qh+bJyEwBCyLv/3bcaHpF8H3hEFLgOJjqgYldL8pZ7s4SwJoaOtUWAZFSiu6wT8Q= X-Received: by 2002:a5d:88ce:: with SMTP id i14mr784062iol.66.1545367806549; Thu, 20 Dec 2018 20:50:06 -0800 (PST) MIME-Version: 1.0 From: Donald Eastlake Date: Thu, 20 Dec 2018 23:49:55 -0500 Message-ID: To: Babel at IETF Cc: babel-chairs Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Dec 2018 04:50:09 -0000 Hi, At the Bangkok IETF meeting we said we would start a WG Last Call on draft-ietf-babel-hmac. So, this message starts such a Last Call. Due to the holidays, this will run through January 13th. Do you think this draft is ready for publication? It is fine to provide suggestions for improvement with your response. Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 1424 Pro Shop Court, Davenport, FL 33896 USA d3e3e3@gmail.com From nobody Fri Dec 21 06:47:02 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A62F1274D0; Fri, 21 Dec 2018 06:47:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rCpHk_By6e_I; Fri, 21 Dec 2018 06:46:58 -0800 (PST) Received: from mail-qk1-x72b.google.com (mail-qk1-x72b.google.com [IPv6:2607:f8b0:4864:20::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3CE6124D68; Fri, 21 Dec 2018 06:46:57 -0800 (PST) Received: by mail-qk1-x72b.google.com with SMTP id a1so3203298qkc.5; Fri, 21 Dec 2018 06:46:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6HhmMYSDxu/85qY9t8ic6zyxJ1j1chVvv60+7l+2fL0=; b=o8JNqQiJ9h/++YJ6p/AiHV37jQJGY/lNwg3rr1ZDiV6v92l4putC+9CnNmj+epvw9j Paqae+BBN3gZMMOKVp5nRhC5quPmG1Nv4ak7rrHRMAK2FLLTiKzR2xnCex615chBroZd iAlKcA1D/g7csOm43ozLsGM5D2C26kRERdKqm6eweUTd73Lrpq0UMeWIh+scPamKSHRX nmTkVUwIkeo6+k0ZJ/y+jC8qPNkOLq4lBme8PFLVdU7UfL5/2hqkVZJVF5rNch7SyP16 j0sUIXXXKx44XL2cfG0OgIg8FGc3ySlrnovYqhaSCvV9CrGqkkM0YC1IO2qHuMAuPE6d bfgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6HhmMYSDxu/85qY9t8ic6zyxJ1j1chVvv60+7l+2fL0=; b=ly/r3i7peoj9Lnbh4NinSlADkdmSt+lsHBn2qKIPQolE4DMMfjEXF3ped/gf6nr10l ZhLK0qB97Y8nz25LiFgbiGSobH85Vh4G1+msxwhyACpX7YejwK5tJUBvFgQngRnsE8T9 zDduf9GuBzjA/OIyYIpyM0pvISB30PX+n1p0XmVKd5HVVMzFgO8I/YX5TaGm+tqsvSUm jJYalzGCXPxjF1toO9vGWMx5Rb1RZEi+J+JsUnac9EhYWD6KhvimMpjQGjzwl0i4arN+ x4Ja8Ov5AIbs6n+0PGBPXIULgq5sjRF3f2b8LaUxsRuyONVt5kn5Hqn15uJ9i6bwFzQ6 nNAA== X-Gm-Message-State: AJcUuke07k10FtoVrtxkiI7JCBQ9OHkituz81gWnWCrJ/RPZjYbfYfnV c49x9RLvGS6jOMmXYuHkrOI/iz0OTw9QrcpX2Js= X-Google-Smtp-Source: ALg8bN4vz03fFheaV0hoXv/lTJNbYVuuprDkx6nTJ8JL39L6kQ59Rz0p3IMk9ja7VFZYJj/t8SWprICzuazPqYt52Fw= X-Received: by 2002:a37:18d5:: with SMTP id 82mr2476350qky.65.1545403616895; Fri, 21 Dec 2018 06:46:56 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Dave Taht Date: Fri, 21 Dec 2018 06:46:44 -0800 Message-ID: To: Donald Eastlake Cc: Babel at IETF , babel-chairs@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Dec 2018 14:47:01 -0000 I am sufficiently old fashioned to want to wait for two interoperable implementations and some field deployment experience before finalizing this document. I would like key rotation to work, and, although it may not be right for this document, the key format as expressed to users, solidified. Treating 0xdeadbeef as a string vs deadbeef as a string results in very different keys. Nits: "The protocol is inapplicable in situations where asymmetric keying is required, where the trust relationship is partial" Given my confusion on this I suggest: "The protocol is inapplicable in situations where asymmetric keying is required, where the trust relationship per interface is partial" ... "and it does not require any form of persistent storage." I would just strike this claim, because it does. While in one embodiment (hnet) it is possible to bootstrap keys, in most others you need a routing protocol running before you can dynamically ship conf files or dynamic configuration to the ends of the network. "per-interface 32-bit integer known as the "packet counter" (PC)." Do we have the blessing of a cryptographer type saying just how secure this and the nonce and index are? I don't use words like "invulnerable" lightly, rather I would say the probability is X of Y. Given the number of fixed, known fields in the shortest possible hello message... ... "Every implementation MUST implement HMAC-SHA256 [RFC6234], and MAY implement other HMAC algorithms. I think we managed to get blake2s up to a SHOULD in the past weeks. :) "Every implementation MUST implement HMAC-SHA256 [RFC6234], SHOULD implement blake2s, and MAY implement other HMAC algorithms. or "SHOULD implement two or more IETF-approved HMAC algorithms". ... "if the PC overflows, a new index is generated;" "*When* the PC overflows", not if. And overflow + new index generation is one of those things that implementors MUST test. I'm not not huge on the word "index", as used throughout, as in most programming contexts that's usually a 32 bit integer. Secondary Nonce? ... "can be fairly large (up to 192 octets)" "There MUST be a minimum size defined for the nonce and index of" (go drinking with a good cryptographer). Otherwise implementors will use a single byte. ... 7. IANA Considerations Has anyone gone to iana so these tlvs can be baked in stone? ... Toke Hoyland-Jorgensen do we have utf-8 support in rfcs yet? From nobody Fri Dec 21 12:07:44 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE57F130E9C; Fri, 21 Dec 2018 12:07:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3FmvHAgA4jj6; Fri, 21 Dec 2018 12:07:40 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07BBB130E94; Fri, 21 Dec 2018 12:07:40 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1545422855; bh=gkidGmrQZoIoJpSXa18spik4xnxgDd65oTLZicKuUa4=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=fEv/ElvrGYZnXZ9ExgocPFLwtE23l1k11ukIr+YlNXeKMJZT61FpL90bKehN7a46B CCa0p5N8ZaEjQT138I9rPC+RNpAXcYVwTeIE8k9dtIZl96tNhQojA5WDOqeYOVC+i0 GzBzNtvZoOHsto8Hquo6PaWUaiNfZi89VrGwVerhJfDz1IP36Jp/RRxOs32tFpbMaf OTInNx7OGvHp51O1upldrPpeOxFvE7uh+mhibPD9uu69ng91kXO9j0z8qOmF4mQs7R uzpWEcgRiicfiVlMWtZGtUNrHjZ53Y63h/0kGsrUzoi5WYUBaRk3yw0hlfjHGXcmGb HxB1saTQSmtHg== To: Dave Taht , Donald Eastlake Cc: babel-chairs@ietf.org, Babel at IETF In-Reply-To: References: Date: Fri, 21 Dec 2018 21:07:34 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <874lb6hce1.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Dec 2018 20:07:43 -0000 Dave Taht writes: > Toke Hoyland-Jorgensen > > do we have utf-8 support in rfcs yet? Heh, yeah. Also, my name is spelled with an i, not a y, regardless of the encoding ;) -Toke From nobody Sat Dec 22 03:32:03 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BB45130FA0; Sat, 22 Dec 2018 03:32:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s1skglC5dcuf; Sat, 22 Dec 2018 03:31:59 -0800 (PST) Received: from mail-pf1-x42b.google.com (mail-pf1-x42b.google.com [IPv6:2607:f8b0:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10F2912D84D; Sat, 22 Dec 2018 03:31:59 -0800 (PST) Received: by mail-pf1-x42b.google.com with SMTP id 64so3814817pfr.9; Sat, 22 Dec 2018 03:31:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1SZ/lnrx7e6tlpTWMBB+vNmnel2rwNMGqReKQ2Mev+0=; b=d3qjZ/3d7iwyH+uhkBCP70kLq/JYMMHagnDKc/zmhFihv4vNHeF5xDmFmyY0dlz7tM lkVZnoYQuD0cQLDPlOfQeD17Cs/8L4iHak/7Cjb4W577OiXpDSX2XtghHM8Hh25nW0Ic LMwbxDB2XGimVojod7x/IKYjQ7NaObfpoh3XPghnMs7spqXHfPk8H+k8z0tyQGYEJJXJ ULpuSoiza0WWIrXiZxFZHykAZ+U8PmLhbXZii6usmoax9Xd1Wh3PTIRh6qQIgdQIGefB BiGySHhSMT80+XJKM9AfQxCsnAExat0amDzgX0sARlG3cu9SXYmthqhwJ+ab/F8gqT9V a5qg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1SZ/lnrx7e6tlpTWMBB+vNmnel2rwNMGqReKQ2Mev+0=; b=GnIrdMYNDEir0il8L33RxBs1LE7Nf0T/Z1yjmMumZUyR7Vf8EOEiF9Lcc7Fs3xVcyF 9V9CYnPcNQqAfxZWfwGJMwvqvH5/yGOShVhmcXw/xbjm4s3OJjDc6cczByJDRdNnCWqh R+/VkBzgwBMpaNmtlApKzuHMPozKVeiQhCsmCdGm9YRAIuEG1KIZ4CcFd80HjmmdwfMw wC9aCw/PWA1wrpjqKz/uK4PsYuL9vOTz7p2LvfPsBemN0th2XRMk8swS+bzE9GVUFbJF J9LXyhc62G7SiU2vsoCRXTiVksc9e5qImQTsmPRK7ARFKd4EUgVHE0bhKLMhTT00UIvy 2BLg== X-Gm-Message-State: AA+aEWYDUxyewbDjmgjKEu6Eea0TnlZf0o1qPXSXYqkI6yMIJZKTeDIE alC9ytExEYJJa4zHNBzjHI5QD4vqg6X0dIZrH7E= X-Google-Smtp-Source: AFSGD/WCdCQgm/ArBvR3z75scLIRJfJLtY0yjVoGI/uLp51x99MXV71HzfCfKvMdt8AFo4hViUEfMWY8MhlEgIYxxMM= X-Received: by 2002:a62:6b8a:: with SMTP id g132mr5535220pfc.201.1545478318599; Sat, 22 Dec 2018 03:31:58 -0800 (PST) MIME-Version: 1.0 References: <874lb6hce1.fsf@toke.dk> In-Reply-To: <874lb6hce1.fsf@toke.dk> From: David Schinazi Date: Sat, 22 Dec 2018 03:31:47 -0800 Message-ID: To: =?UTF-8?B?VG9rZSBIw7hpbGFuZC1Kw7hyZ2Vuc2Vu?= Cc: Dave Taht , Donald Eastlake , babel-chairs@ietf.org, Babel at IETF Content-Type: multipart/alternative; boundary="0000000000003031c4057d9ab6fa" Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Dec 2018 11:32:01 -0000 --0000000000003031c4057d9ab6fa Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I personally believe the HMAC document is ready for publication. I think Dave's points about key rotation and config file format are interesting, but I see them as implementation details that do not necessarily belong in the IETF spec. David On Fri, Dec 21, 2018 at 12:07 PM Toke H=C3=B8iland-J=C3=B8rgensen wrote: > Dave Taht writes: > > > Toke Hoyland-Jorgensen > > > > do we have utf-8 support in rfcs yet? > > Heh, yeah. Also, my name is spelled with an i, not a y, regardless of > the encoding ;) > > -Toke > > _______________________________________________ > babel mailing list > babel@ietf.org > https://www.ietf.org/mailman/listinfo/babel > --0000000000003031c4057d9ab6fa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I personally believe the HMAC document is ready for public= ation.

I think Dave's points about key rotation and = config file format are interesting, but I see them as implementation detail= s that do not necessarily belong in the IETF spec.

David

On Fri, D= ec 21, 2018 at 12:07 PM Toke H=C3=B8iland-J=C3=B8rgensen <toke@toke.dk> wrote:
Dave Taht <dave.taht@gmail.com> writes:

> Toke Hoyland-Jorgensen
>
> do we have utf-8 support in rfcs yet?

Heh, yeah. Also, my name is spelled with an i, not a y, regardless of
the encoding ;)

-Toke

_______________________________________________
babel mailing list
babel@ietf.org
https://www.ietf.org/mailman/listinfo/babel
--0000000000003031c4057d9ab6fa-- From nobody Sat Dec 22 07:17:43 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4B28126CC7; Sat, 22 Dec 2018 07:17:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QZRi8ppuxzKB; Sat, 22 Dec 2018 07:17:39 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95AE3123FFD; Sat, 22 Dec 2018 07:17:39 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBMFHSXE008334; Sat, 22 Dec 2018 16:17:28 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id AD26F855D5; Sat, 22 Dec 2018 16:17:34 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id QK04BXE9Cq_3; Sat, 22 Dec 2018 16:17:32 +0100 (CET) Received: from pirx.irif.fr (user-46-112-148-30.play-internet.pl [46.112.148.30]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 744CE855D3; Sat, 22 Dec 2018 16:17:30 +0100 (CET) Date: Sat, 22 Dec 2018 16:17:26 +0100 Message-ID: <87muoxlhfd.wl-jch@irif.fr> From: Juliusz Chroboczek To: David Schinazi Cc: Toke =?ISO-8859-1?Q?H=F8iland-J=F8rgensen?= , Donald Eastlake , babel-chairs@ietf.org, Dave Taht , Babel at IETF In-Reply-To: References: <874lb6hce1.fsf@toke.dk> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sat, 22 Dec 2018 16:17:30 +0100 (CET) X-Miltered: at korolev with ID 5C1E5588.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1E5588.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1E5588.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Dec 2018 15:17:42 -0000 > I think Dave's points about key rotation and config file format are > interesting, but I see them as implementation details that do not necessarily > belong in the IETF spec. I agree. However, I have one nit against both HMAC and DTLS which I'll write up on the list ASAP. -- Juliusz From nobody Sat Dec 22 07:45:29 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCC0F12785F for ; Sat, 22 Dec 2018 07:45:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Eir7eJoIlmX for ; Sat, 22 Dec 2018 07:45:27 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DA70A1277CC for ; Sat, 22 Dec 2018 07:45:26 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBMFjJI9019350 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Sat, 22 Dec 2018 16:45:19 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wBMFjLMn006875 for ; Sat, 22 Dec 2018 16:45:21 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 33A0985933 for ; Sat, 22 Dec 2018 16:45:25 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id Mw9IDfZ9n_LF for ; Sat, 22 Dec 2018 16:45:23 +0100 (CET) Received: from pirx.irif.fr (user-46-112-148-30.play-internet.pl [46.112.148.30]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 1243285926 for ; Sat, 22 Dec 2018 16:45:17 +0100 (CET) Date: Sat, 22 Dec 2018 16:45:15 +0100 Message-ID: <87lg4hlg50.wl-jch@irif.fr> From: Juliusz Chroboczek To: babel@ietf.org User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sat, 22 Dec 2018 16:45:19 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sat, 22 Dec 2018 16:45:21 +0100 (CET) X-Miltered: at korolev with ID 5C1E5C0F.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C1E5C11.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1E5C0F.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C1E5C11.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1E5C0F.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C1E5C11.000 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: [babel] HMAC and DTLS cryptographic state can be maintained indefinitely X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Dec 2018 15:45:29 -0000 Hi. I think I have a nit against both Babel security drafts (HMAC and DTLS). The fix is easy, but I'd like to hear the list's opinion first. Executive summary: both security mechanisms associate the cryptographic state with the neighbour entry. In both mechanisms, an attacker may prevent the neighbour entry from expiriting, thus maintaining the cryptographic state for an arbitrary time. While this does not lead to any obvious vulnerability, it is worrying, and should be fixed. Fortunately, the fix is easy. 1. The issue Both security mechanisms rely on a pairwise exchange that leads to both peers estabilishing cryptographic state in their neighbour tables. In the case of HMAC, the cryptographic exchange is called the "challenge", and the state is the current index and seqno. In the case of DTLS, the exchange is the DTLS handshake, and the state is the current DTLS state. If A has a neighbour entry for a peer B, and the peer B leaves the network, then A's neighbour entry for B will eventually expire. However, in some cases an attacker C can prevent the neighour entry for B from expiring, as described below. 1.1 HMAC In HMAC, an attacker can replay a correctly signed packet with an index different from A's current index. This causes B to send a challenge, and keep the challenge data in the neighbour entry; if replayed packets are sent often enough, the neighbour entry will never expire, and the cryptographic state will live forever. 1.2 DTLS In DTLS, Hellos are unauthentified. Hence, it is enough for the attacker to send fake Hellos to prevent the neighbour entry from expiring. 2. What can an attacker do? The issue outlined above does not cause an obvious vulnerability -- the cryptographic state does not allow any obvious replay attacks. There is one troubling case, though. Suppose that just before B leaves the network, it sends an announcement that is not received by A (due to packet loss), but is captured by an attacker C. Then C may choose to maintain A's cryptographic state for a long time, then replay B's announcement. It can do that only once -- if it attempts to replay it twice, then A's replay detection mechanism will trigger. It's not obvious if delaying a single announcement by an arbitrary amount of time is a vulnerability, but I'm sure I'm not the only person it makes feel uncomfortable. 3. The fix The obvious fix is to require that A discards its cryptographic state after a bounded amount of time. In HMAC, Hellos are authentified, so it is an easy matter to simply discard the cryptographic state (but not the neighbour entry) whenever the Hello history becomes empty. I am planning to add wording to that effect to Section 4.1 of the draft: The receiver MUST ensure that the cryptographic state (index and seqno) is discarded after no packet has been accepted for the sender for a bounded time. A simple solution is to discard the index and seqno whenever the both hello histories in the neighbour entry becomes empty (see Appendix A of RFC6126bis); another solution is to discard the index and seqno after a fixed time interval (e.g. 5 minutes) has elapsed since the last accepted packet. In DTLS, Hellos are not authentified, so the above solution won't work. I suggest requiring that the DTLS state be discarded whenever the IHU timer expires. 4. Please comment I'm going to update the DTLS draft pretty soon, so please comment. 5. Acknowledgments Thanks to Pierre Letouzey and Yann Régis-Gianas for the discussion that lead to the issue described in this mail. From nobody Sat Dec 22 07:55:45 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5BAC12785F for ; Sat, 22 Dec 2018 07:55:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 47WxKGHDotab for ; Sat, 22 Dec 2018 07:55:41 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACB891277D2 for ; Sat, 22 Dec 2018 07:55:41 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1545494108; bh=xl+/TUV6rz/vlwY+tIFuo26bBwGYhw4R/xZlT3TrXXE=; h=From:To:Subject:In-Reply-To:References:Date:From; b=epNzWNhrt+PQLmd0KAMfyarn32U63yTkScrkOoX3afbyWLDTwG1g/whq4bacXLdub p/qmMQi975oGYOvjNHqt9YSaR5okTZZuDyPco7tKYtCuWEdFN8GX8oqCHLnPrZ70tJ cg2BATbtpj7GxFubzjvfTY4niGeI6Xs6GCnAlhUjM8Ljevd/6RECVpBV9ygvgFy7De pPAm4sRecGVHXpN31Ywovf7RMFGOahWW2GcU9MfhNwJ7A3u0wSh8hHEmWQHQ9cTSQJ /SAwbrGzvBXQ0HCu/hiCGNIdHTmPb4QrQboAfhdzZO5R2BIpNcWAwScOPTNE5OF+Ih NrjVzbVlqyWAg== To: Juliusz Chroboczek , babel@ietf.org In-Reply-To: <87lg4hlg50.wl-jch@irif.fr> References: <87lg4hlg50.wl-jch@irif.fr> Date: Sat, 22 Dec 2018 16:55:07 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87y38hftes.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] HMAC and DTLS cryptographic state can be maintained indefinitely X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Dec 2018 15:55:44 -0000 Juliusz Chroboczek writes: > In HMAC, Hellos are authentified, so it is an easy matter to simply > discard the cryptographic state (but not the neighbour entry) whenever the > Hello history becomes empty. I am planning to add wording to that effect > to Section 4.1 of the draft: > > The receiver MUST ensure that the cryptographic state (index and seqno) > is discarded after no packet has been accepted for the sender for > a bounded time. A simple solution is to discard the index and seqno > whenever the both hello histories in the neighbour entry becomes empty > (see Appendix A of RFC6126bis); another solution is to discard the index > and seqno after a fixed time interval (e.g. 5 minutes) has elapsed since > the last accepted packet. I have no objections to this :) -Toke From nobody Sat Dec 22 08:21:35 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A57B127B4C for ; Sat, 22 Dec 2018 08:21:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N1SE8KdWG_bk for ; Sat, 22 Dec 2018 08:21:31 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44F46127AC2 for ; Sat, 22 Dec 2018 08:21:31 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBMGLLCq029402 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 22 Dec 2018 17:21:21 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wBMGLMY4014400; Sat, 22 Dec 2018 17:21:23 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 1B99185E08; Sat, 22 Dec 2018 17:21:27 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id Xh_tsNszsY5F; Sat, 22 Dec 2018 17:21:24 +0100 (CET) Received: from pirx.irif.fr (user-46-112-148-30.play-internet.pl [46.112.148.30]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id D366B85E06; Sat, 22 Dec 2018 17:21:23 +0100 (CET) Date: Sat, 22 Dec 2018 17:21:22 +0100 Message-ID: <87efa9legt.wl-jch@irif.fr> From: Juliusz Chroboczek To: "STARK, BARBARA H" Cc: Babel at IETF In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114DF65C81@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114DF65C81@GAALPA1MSGUSRBF.ITServices.sbc.com> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sat, 22 Dec 2018 17:21:21 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sat, 22 Dec 2018 17:21:23 +0100 (CET) X-Miltered: at korolev with ID 5C1E6481.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C1E6482.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1E6481.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C1E6482.001 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1E6481.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C1E6482.001 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] info-model: message log X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Dec 2018 16:21:33 -0000 > Here is my suggestion for having a message log: > babel-message-log is: > A reference or url link to a file that contains a timestamped log of messages received and sent on babel-udp-port on all interfaces. File format MUST be readable by Wireshark 1.8 or later and use the applicable file format extension in the filename. Logging is enabled / disabled by babel-message-log-enable. Wireshark supports multiple formats, I'm not sure that it's a good idea to allow all of the formats supported by Wireshark. I'm not intimately familiar with the capture packet formats. The pcapng file format appears to be the preferred format for wireshark, but the internet-draft is expired since 2014; what's more, I'm not sure it's supported by libpcap. The traditional libpcap format is documented here: https://wiki.wireshark.org/Development/LibpcapFileFormat and it's likely to be supported by any tool in existence. Unless somebody has good technical reasons to avoid libpcap, I suggest we should mandate that format. -- Juliusz From nobody Sat Dec 22 08:25:52 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7C2012872C for ; Sat, 22 Dec 2018 08:25:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wPcCtsZFuqWw for ; Sat, 22 Dec 2018 08:25:50 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11E13127AC2 for ; Sat, 22 Dec 2018 08:25:49 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBMGPfEN030812; Sat, 22 Dec 2018 17:25:41 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id EC6BA85E96; Sat, 22 Dec 2018 17:25:47 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id p_Bgp3gAQv_5; Sat, 22 Dec 2018 17:25:45 +0100 (CET) Received: from pirx.irif.fr (user-46-112-148-30.play-internet.pl [46.112.148.30]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 6A52485E93; Sat, 22 Dec 2018 17:25:44 +0100 (CET) Date: Sat, 22 Dec 2018 17:25:43 +0100 Message-ID: <87d0ptle9k.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: babel-users , Babel at IETF In-Reply-To: References: User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sat, 22 Dec 2018 17:25:41 +0100 (CET) X-Miltered: at korolev with ID 5C1E6585.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1E6585.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1E6585.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] BASE64 and hex encoding HMAC keys for user presentation X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Dec 2018 16:25:52 -0000 > I would like the bird and babel implementations to allow for and use > BASE64 and hex encodings. > This allows for a shorter, more human friendly representation of both > cryptographically generated keys and the keys humans are more likely > to remember and type without error. In the latter case, guidelines as > to length, mixed case and punctuation would be useful. I think that the HMAC key should be generated automatically. I'd hope that any actual production deployment of HMAC would generate HMAC keys either randomly or by using a suitable KDF (or whatever the right acronym is) and distribute it automatically. (At the current time, I'm not advocating designing a key distribution protocol to go with HMAC -- I'm in favour of using a centralised script that uses ssh to distribute keys. Please see https://cr.yp.to/djbdns/tcp.html) So no, I'd rather not encourage people to generate HMAC keys manually. -- Juliusz From nobody Sat Dec 22 08:36:24 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D06E912875B for ; Sat, 22 Dec 2018 08:36:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id arcE53ev3TuI for ; Sat, 22 Dec 2018 08:36:19 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F232112872C for ; Sat, 22 Dec 2018 08:36:18 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1545496545; bh=DlueIoogFAas1rhl6FPingzHvmlWoPKlStA/m62sjrg=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=XqCSni7yQRzcuby//gyDSCPkAQXUKLKYHnyB3QoqBLSSkLLO3Mx5XdZ8PlXeXosM5 3hzSRo/xuih7XK/066FKR1Zb0AVWBlLT0BjJ8nrJ0g+bBSuWJN070ixBshIlQSOd9m CD9qBENRFqzD/4JTL7128WxCgv7HAoAKHv4lExuZoCoXTe0wYMbSch8q0+zISQEK57 HPv/WQsKy1R9TRkeAysdEoaU+C8dmmxaFhnZYG7lALPDWiKlt83/XSrw6OuseoV24s WUGChn6tjB0xvIKEVlMpFi4iA6GTxTqMLW0ozM8zq+ARYV4DBF1xJ+lK6xrvgcwPHl QY4fYd4JGr4ug== To: Juliusz Chroboczek , Dave Taht Cc: babel-users , Babel at IETF In-Reply-To: <87d0ptle9k.wl-jch@irif.fr> References: <87d0ptle9k.wl-jch@irif.fr> Date: Sat, 22 Dec 2018 17:35:43 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87va3lfrj4.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] [Babel-users] BASE64 and hex encoding HMAC keys for user presentation X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Dec 2018 16:36:22 -0000 Juliusz Chroboczek writes: >> I would like the bird and babel implementations to allow for and use >> BASE64 and hex encodings. > >> This allows for a shorter, more human friendly representation of both >> cryptographically generated keys and the keys humans are more likely >> to remember and type without error. In the latter case, guidelines as >> to length, mixed case and punctuation would be useful. > > I think that the HMAC key should be generated automatically. I'd hope > that any actual production deployment of HMAC would generate HMAC keys > either randomly or by using a suitable KDF (or whatever the right acronym > is) and distribute it automatically. Should we pick a KDF? Not necessarily for the RFC, but at least try to get compatibility between bird and babeld, so users can just input a password and expect things to work? -Toke From nobody Sun Dec 23 03:18:08 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9542112D4F1 for ; Sun, 23 Dec 2018 03:18:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1FyHOQByzku8 for ; Sun, 23 Dec 2018 03:18:06 -0800 (PST) Received: from mail-pf1-x431.google.com (mail-pf1-x431.google.com [IPv6:2607:f8b0:4864:20::431]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F072E12958B for ; Sun, 23 Dec 2018 03:18:05 -0800 (PST) Received: by mail-pf1-x431.google.com with SMTP id b85so4691481pfc.3 for ; Sun, 23 Dec 2018 03:18:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jl6AoOkBOQ8fU+sUE+EoZ1z3IVsF2Gu3Dv4ftchER/o=; b=jVFEH9mm7CtiNfe+0x1tnhqHsQGvhqX5GTi3tOMs0g4lcrP8kKNBuHWciGCP97Xgtd uLuWpajgmWbKeIFDfJVbbqQhCnTkv+rGydXMRCdmy60PY7yECegz8oaSskHlGrmv3Zl2 5ixx7wLqoZun4+yM3dTmQDBHk7q43nJ/V2PikMgZ9DvGs/+UmcKihDfOtWwVAcVjw6wj /4XaD9K5riC5ARLL/7dfRd4CBFQ/YSVQJEhXyGEIEyKzLz0dXamglRsGSvY1o/WiZjDa T3pDj/iDHzgHaVEBdyAKLqgiwjGsVOufrZ3MK0jL7ofnVH/e5vSYCtsp4zj37PwQ7avg p+Sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jl6AoOkBOQ8fU+sUE+EoZ1z3IVsF2Gu3Dv4ftchER/o=; b=IntZTGNh+4cLb4Xo5YQiB2iu2MQeB83Iz5J5gn5Fi5svR/t1bQ3EY6VtJqAf1WDBL+ QUu+Q37oLAoZ9WTk+zwWXZZ2bEORzm4NGHFn7ZvE7465E9ZOX9acwVj2XwIuNXMQVAHT sLVbn3vBy/y/lc9a9b5v+LexCIYCIkJmzol6r+jBVmQ9Zc69H8JclebiCX9PXrfsNIVd CkpQyQHN0Wbm3/Gk4mvZuPpOU3tb5ojHlex6w+wYtmRmTAg87znrJQA9Jqgf/Q1PKBVK 5iC1zASa7QRknghbmAB9B0t1EAzT8+ItiFXz3bF91IXaJZW/YbIeL8j6ZHXfEDVXE/kr z+Sw== X-Gm-Message-State: AJcUukfd+uRVAIwaNVhDV+GX5NnfGAxjZ1ctmbfr5sWY0ZfpNvUjT6Pj P2JKtbnmuxaUeW38fMhzzB2lRHz4yype47XXxV4kMg== X-Google-Smtp-Source: ALg8bN4FsqemVy9ga+5t4mjpamexGzmX29yekpuUCBdzKaa6y8jqPRWtD0uAqo1kLSveEiPiXLI/xwkK4lE7wL4MqEY= X-Received: by 2002:a63:4f20:: with SMTP id d32mr8843130pgb.47.1545563885426; Sun, 23 Dec 2018 03:18:05 -0800 (PST) MIME-Version: 1.0 References: <87lg4hlg50.wl-jch@irif.fr> <87y38hftes.fsf@toke.dk> In-Reply-To: <87y38hftes.fsf@toke.dk> From: David Schinazi Date: Sun, 23 Dec 2018 03:17:54 -0800 Message-ID: To: =?UTF-8?B?VG9rZSBIw7hpbGFuZC1Kw7hyZ2Vuc2Vu?= Cc: Juliusz Chroboczek , Babel at IETF Content-Type: multipart/alternative; boundary="0000000000005e5f9e057daea28a" Archived-At: Subject: Re: [babel] HMAC and DTLS cryptographic state can be maintained indefinitely X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 11:18:08 -0000 --0000000000005e5f9e057daea28a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I agree with the attack and the solution. Can we also add your analysis to the Security Considerations section of both drafts? That way someone reading the text about when to discard this state has a pointer to what would happen if they don't - my thinking is that the consequences here are very minor so I wouldn't want a reader to start worrying about a much worse attack that they're not seeing. David On Sat, Dec 22, 2018 at 7:55 AM Toke H=C3=B8iland-J=C3=B8rgensen wrote: > Juliusz Chroboczek writes: > > > In HMAC, Hellos are authentified, so it is an easy matter to simply > > discard the cryptographic state (but not the neighbour entry) whenever > the > > Hello history becomes empty. I am planning to add wording to that effe= ct > > to Section 4.1 of the draft: > > > > The receiver MUST ensure that the cryptographic state (index and seqn= o) > > is discarded after no packet has been accepted for the sender for > > a bounded time. A simple solution is to discard the index and seqno > > whenever the both hello histories in the neighbour entry becomes empt= y > > (see Appendix A of RFC6126bis); another solution is to discard the > index > > and seqno after a fixed time interval (e.g. 5 minutes) has elapsed > since > > the last accepted packet. > > I have no objections to this :) > > -Toke > > _______________________________________________ > babel mailing list > babel@ietf.org > https://www.ietf.org/mailman/listinfo/babel > --0000000000005e5f9e057daea28a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I agree with the attack and the solution. Can we also add = your analysis to
the Security Considerations section of both drafts? Th= at way someone
reading the text about when to discard this state = has a pointer to what
would happen if they don't - my thinkin= g is that the consequences here are
very minor so I wouldn't = want a reader to start worrying about a much
worse attack that th= ey're not seeing.

David

On Sat, Dec 22, 2018 at 7:55 AM Toke H= =C3=B8iland-J=C3=B8rgensen <toke@toke.dk= > wrote:
= Juliusz Chroboczek <jch= @irif.fr> writes:

> In HMAC, Hellos are authentified, so it is an easy matter to simply > discard the cryptographic state (but not the neighbour entry) whenever= the
> Hello history becomes empty.=C2=A0 I am planning to add wording to tha= t effect
> to Section 4.1 of the draft:
>
>=C2=A0 =C2=A0The receiver MUST ensure that the cryptographic state (ind= ex and seqno)
>=C2=A0 =C2=A0is discarded after no packet has been accepted for the sen= der for
>=C2=A0 =C2=A0a bounded time.=C2=A0 A simple solution is to discard the = index and seqno
>=C2=A0 =C2=A0whenever the both hello histories in the neighbour entry b= ecomes empty
>=C2=A0 =C2=A0(see Appendix A of RFC6126bis); another solution is to dis= card the index
>=C2=A0 =C2=A0and seqno after a fixed time interval (e.g. 5 minutes) has= elapsed since
>=C2=A0 =C2=A0the last accepted packet.

I have no objections to this :)

-Toke

_______________________________________________
babel mailing list
babel@ietf.org
https://www.ietf.org/mailman/listinfo/babel
--0000000000005e5f9e057daea28a-- From nobody Sun Dec 23 06:12:03 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9846A12426A; Sun, 23 Dec 2018 06:12:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 00B8WoNc1M6J; Sun, 23 Dec 2018 06:11:59 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02DBD126C7E; Sun, 23 Dec 2018 06:11:58 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1545574316; bh=pla4hIKTnRPBXenCs3Y9zWov7gTCIMH9qWJbQzUtmHQ=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=G6iDBPAb85vJjncgOmFIFZdbPDittIO88OEGz06NsuCwfr7Y6NAguyx4eNJvV8pd5 vqMraLnTqcXsnU2W45pErLU5yMn4rK5rwsXRf7MbRrGM3RIYIw7qfJ0cysQels+G6Y qpp0L0r9/fQz/glUPzgnkUoSStiZJ6C59yW4IlQfPCW2L5GhdhLPPCesBuULr6xIsq 74vaqEbx2EMuDhjlCx2ajtmjX+jjPXIb7w5ch9K76zNEmqIwYaUI2MXtZl6OeGGmV+ ZDvDiPMf7392xSBllkR/R4pRw5PLjcPWf+zZluK94RqaqgXVTPCP4YB1wum/HK9zAt tj+GEkIAkXtAg== To: Dave Taht , Donald Eastlake Cc: babel-chairs@ietf.org, Babel at IETF In-Reply-To: References: Date: Sun, 23 Dec 2018 15:11:54 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87pntsfi39.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 14:12:02 -0000 Dave Taht writes: > > "Every implementation MUST implement HMAC-SHA256 > [RFC6234], and MAY implement other HMAC algorithms. > > I think we managed to get blake2s up to a SHOULD in the past weeks. :) > > "Every implementation MUST implement HMAC-SHA256 > [RFC6234], SHOULD implement blake2s, and MAY implement other HMAC algorithms. +1 on this, BTW :) > .... > > 7. IANA Considerations > > Has anyone gone to iana so these tlvs can be baked in stone? And yeah, this would be useful to have set before I submit the Bird patch upstream. -Toke From nobody Sun Dec 23 07:39:37 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A57B12426A for ; Sun, 23 Dec 2018 07:39:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.401 X-Spam-Level: X-Spam-Status: No, score=-0.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SORBS_WEB=1.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jj7rL7xWOHdT for ; Sun, 23 Dec 2018 07:39:33 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5161812008F for ; Sun, 23 Dec 2018 07:39:33 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBNFdNDe028047; Sun, 23 Dec 2018 16:39:23 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 4933291496; Sun, 23 Dec 2018 16:39:29 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id YBoPYYEjvWHb; Sun, 23 Dec 2018 16:39:27 +0100 (CET) Received: from pirx.irif.fr (user-46-112-52-12.play-internet.pl [46.112.52.12]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id DD28491493; Sun, 23 Dec 2018 16:39:23 +0100 (CET) Date: Sun, 23 Dec 2018 16:39:20 +0100 Message-ID: <87o99cuuaf.wl-jch@irif.fr> From: Juliusz Chroboczek To: David Schinazi Cc: Toke =?ISO-8859-1?Q?H=F8iland-J=F8rgensen?= , Babel at IETF In-Reply-To: References: <87lg4hlg50.wl-jch@irif.fr> <87y38hftes.fsf@toke.dk> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sun, 23 Dec 2018 16:39:24 +0100 (CET) X-Miltered: at korolev with ID 5C1FAC2B.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1FAC2B.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1FAC2B.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] HMAC and DTLS cryptographic state can be maintained indefinitely X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 15:39:35 -0000 > I agree with the attack and the solution. Can we also add your analysis to > the Security Considerations section of both drafts? Yes, we should do. -- Juliusz From nobody Sun Dec 23 12:14:38 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 890521277CC; Sun, 23 Dec 2018 12:14:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S60n0cCQXVBt; Sun, 23 Dec 2018 12:14:35 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A63BF1277BB; Sun, 23 Dec 2018 12:14:34 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBNKEP1U017360; Sun, 23 Dec 2018 21:14:25 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 1F81293B8A; Sun, 23 Dec 2018 21:14:32 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id oAUMwx7s7O_e; Sun, 23 Dec 2018 21:14:29 +0100 (CET) Received: from pirx.irif.fr (user-164-126-143-147.play-internet.pl [164.126.143.147]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 3627693B88; Sun, 23 Dec 2018 21:14:28 +0100 (CET) Date: Sun, 23 Dec 2018 21:14:26 +0100 Message-ID: <87bm5cuhjx.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: Donald Eastlake , babel-chairs@ietf.org, Babel at IETF In-Reply-To: References: User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sun, 23 Dec 2018 21:14:26 +0100 (CET) X-Miltered: at korolev with ID 5C1FECA1.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1FECA1.001 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1FECA1.001 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 20:14:37 -0000 Hi Dave, and thanks for your comments. > "and it does not require any form of persistent storage." > I would just strike this claim, because it does. While in one > embodiment (hnet) it is possible to bootstrap keys, in most others you > need a routing protocol running before you can dynamically ship conf > files or dynamic configuration to the ends of the network. I've clarified that. (The claim here is that there is no storage necessary for indices and seqnos -- indices and seqnos can be discarded when a router reboots, at the cost of a mere RTT of lost data (the time needed for a challenge). Of course, persistent storage is needed for storing keys.) > "per-interface 32-bit integer known as the "packet counter" (PC)." > Do we have the blessing of a cryptographer type saying just how secure > this and the nonce and index are? What do you mean? > "Every implementation MUST implement HMAC-SHA256 > [RFC6234], and MAY implement other HMAC algorithms. > I think we managed to get blake2s up to a SHOULD in the past weeks. :) Yep. > "Every implementation MUST implement HMAC-SHA256 [RFC6234], SHOULD > implement blake2s, and MAY implement other HMAC algorithms. Yep, but with a precise reference (chapter and verse). > "SHOULD implement two or more IETF-approved HMAC algorithms". Nope. The IETF is not in the business of approving HMAC algorithms. > "if the PC overflows, a new index is generated;" > "*When* the PC overflows", not if. I'm not sure what your point is. A PC overflow will happen once in 4 billion Babel packets. With reasonable parameters, that's once in a few hundred years. > And overflow + new index generation is one of those things that > implementors MUST test. If an implementation is buggy, it will become unreachable after a few hundred years without a reboot. I'm not too worried. > I'm not not huge on the word "index", as used throughout, as in most > programming contexts that's usually a 32 bit integer. Secondary Nonce? It was originally the "sender's nonce", but David pointed out it's not a nonce (it's used multiple times). I then suggested "tag", but David pointed out that the term "tag" has a different meaning in a security context. Index is unusual, granted, but it makes sense: the protocol relies on having multiple sequences of PCs, and the index identifies the PC sequence we're in right now -- think of it as indexing a (virtual) table of PC sequences. > "can > be fairly large (up to 192 octets)" > "There MUST be a minimum size defined for the nonce and index of" (go > drinking with a good cryptographer). You don't need a cryptographer, it's a rather trivial probability computation. Advice is given in the third paragraph of the Security Considerations section. > Otherwise implementors will use a single byte. If an implementation never loses its PC (e.g. because it has a reliable hardware clock), size 0 indices make perfect sense. For nonces, you need to make sure that a nonce is never reused for a given (key, source, destination) triplet. If you have reliable persistent state, then you can use a counter that is set to 0 whenever you rekey. The counter can be encoded in the minimum number of octets necessary, and hence when the counter is 0, a 0-byte nonce makes perfect sense. In short, 0-byte indices and nonces make perfect sense, and I'm opposed to fixing a minimum size. > 7. IANA Considerations > Has anyone gone to iana so these tlvs can be baked in stone? Donald? -- Juliusz From nobody Sun Dec 23 12:16:21 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B823F1277BB for ; Sun, 23 Dec 2018 12:16:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lK4aSdSfQsRG for ; Sun, 23 Dec 2018 12:16:18 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B292126CC7 for ; Sun, 23 Dec 2018 12:16:18 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBNKG8Im017903; Sun, 23 Dec 2018 21:16:08 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 09CF393BE4; Sun, 23 Dec 2018 21:16:15 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id JkcE92X05ffn; Sun, 23 Dec 2018 21:16:13 +0100 (CET) Received: from pirx.irif.fr (user-164-126-143-147.play-internet.pl [164.126.143.147]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 291E193BE2; Sun, 23 Dec 2018 21:16:12 +0100 (CET) Date: Sun, 23 Dec 2018 21:16:10 +0100 Message-ID: <87a7kwuhh1.wl-jch@irif.fr> From: Juliusz Chroboczek To: Toke =?ISO-8859-1?Q?H=F8iland-J=F8rgensen?= Cc: Babel at IETF In-Reply-To: <874lb6hce1.fsf@toke.dk> References: <874lb6hce1.fsf@toke.dk> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sun, 23 Dec 2018 21:16:10 +0100 (CET) X-Miltered: at korolev with ID 5C1FED08.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1FED08.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1FED08.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 20:16:20 -0000 > Heh, yeah. Also, my name is spelled with an i, not a y, regardless of > the encoding ;) That changes your position in the alphabetic ordering in the Acknowledgements section ;-) Fixed, sorry for that. -- Juliusz From nobody Sun Dec 23 12:36:24 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECAB71277BB; Sun, 23 Dec 2018 12:36:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LBDNa7kjmiPp; Sun, 23 Dec 2018 12:36:22 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3AFD126CC7; Sun, 23 Dec 2018 12:36:21 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBNKaDAI023998 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 23 Dec 2018 21:36:13 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wBNKaFjB031553; Sun, 23 Dec 2018 21:36:15 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 7181193E40; Sun, 23 Dec 2018 21:36:19 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id IWP6KLxtEx5V; Sun, 23 Dec 2018 21:36:17 +0100 (CET) Received: from pirx.irif.fr (user-164-126-143-147.play-internet.pl [164.126.143.147]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 16A8B93E3E; Sun, 23 Dec 2018 21:36:16 +0100 (CET) Date: Sun, 23 Dec 2018 21:36:15 +0100 Message-ID: <878t0gugjk.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: babel-chairs@ietf.org, Babel at IETF In-Reply-To: References: User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sun, 23 Dec 2018 21:36:13 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sun, 23 Dec 2018 21:36:15 +0100 (CET) X-Miltered: at korolev with ID 5C1FF1BD.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C1FF1BF.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1FF1BD.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C1FF1BF.001 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1FF1BD.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C1FF1BF.001 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 20:36:23 -0000 > "Every implementation MUST implement HMAC-SHA256 > [RFC6234], and MAY implement other HMAC algorithms. > I think we managed to get blake2s up to a SHOULD in the past weeks. :) Every implementation MUST implement HMAC-SHA256 as defined in [RFC6234] and Section 2 of [RFC2104], SHOULD implement keyed BLAKE2s [RFC7693], and MAY implement other HMAC algorithms. Ok? -- Juliusz From nobody Sun Dec 23 12:40:21 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 628301277BB for ; Sun, 23 Dec 2018 12:40:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TtjDDlv3qVo7 for ; Sun, 23 Dec 2018 12:40:18 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B97B8126CC7 for ; Sun, 23 Dec 2018 12:40:17 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBNKe8QV024784; Sun, 23 Dec 2018 21:40:08 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id BEF0493EB3; Sun, 23 Dec 2018 21:40:14 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id YiA8UuLdkG6R; Sun, 23 Dec 2018 21:40:12 +0100 (CET) Received: from pirx.irif.fr (user-164-126-143-147.play-internet.pl [164.126.143.147]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 4FE1293EAE; Sun, 23 Dec 2018 21:40:11 +0100 (CET) Date: Sun, 23 Dec 2018 21:40:10 +0100 Message-ID: <877eg0ugd1.wl-jch@irif.fr> From: Juliusz Chroboczek To: Toke =?ISO-8859-1?Q?H=F8iland-J=F8rgensen?= Cc: Dave Taht , babel-users , Babel at IETF In-Reply-To: <87va3lfrj4.fsf@toke.dk> References: <87d0ptle9k.wl-jch@irif.fr> <87va3lfrj4.fsf@toke.dk> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sun, 23 Dec 2018 21:40:09 +0100 (CET) X-Miltered: at korolev with ID 5C1FF2A8.002 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C1FF2A8.002 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C1FF2A8.002 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] [Babel-users] BASE64 and hex encoding HMAC keys for user presentation X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 20:40:19 -0000 >> I think that the HMAC key should be generated automatically. I'd hope >> that any actual production deployment of HMAC would generate HMAC keys >> either randomly or by using a suitable KDF (or whatever the right acronym >> is) and distribute it automatically. > Should we pick a KDF? Not necessarily for the RFC, but at least try to > get compatibility between bird and babeld, so users can just input a > password and expect things to work? I think we might need more deployment experience before we can answer that. At this early stage, however, I wouldn't expect the master key to be distributed -- the KDF would be applied to the master key on a central node, and the derived secret is what gets distributed to the babeld and BIRD instances. So having a common syntax for the HMAC secret should be good enough. -- Juliusz From nobody Sun Dec 23 13:19:53 2018 Return-Path: X-Original-To: babel@ietf.org Delivered-To: babel@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C14BB126CC7; Sun, 23 Dec 2018 13:19:49 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: babel@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.89.2 Auto-Submitted: auto-generated Precedence: bulk Reply-To: babel@ietf.org Message-ID: <154559998975.4428.5323789975171685208@ietfa.amsl.com> Date: Sun, 23 Dec 2018 13:19:49 -0800 Archived-At: Subject: [babel] I-D Action: draft-ietf-babel-hmac-02.txt X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 21:19:50 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Babel routing protocol WG of the IETF. Title : HMAC authentication for the Babel routing protocol Authors : Clara Do Weronika Kolodziejak Juliusz Chroboczek Filename : draft-ietf-babel-hmac-02.txt Pages : 17 Date : 2018-12-23 Abstract: This document describes a cryptographic authentication for the Babel routing protocol that has provisions for replay avoidance. This document updates RFC 6126bis and obsoletes RFC 7298. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-babel-hmac/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-babel-hmac-02 https://datatracker.ietf.org/doc/html/draft-ietf-babel-hmac-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-babel-hmac-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Dec 23 13:40:42 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CE12127B4C for ; Sun, 23 Dec 2018 13:40:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WwFaqj0xoND8 for ; Sun, 23 Dec 2018 13:40:39 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C279C126CC7 for ; Sun, 23 Dec 2018 13:40:38 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBNLeUeX016470 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 23 Dec 2018 22:40:30 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wBNLeWwa021415; Sun, 23 Dec 2018 22:40:32 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 5C83F948F7; Sun, 23 Dec 2018 22:40:36 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id 4kZ3O_Ke2FiD; Sun, 23 Dec 2018 22:40:34 +0100 (CET) Received: from pirx.irif.fr (user-164-126-143-147.play-internet.pl [164.126.143.147]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 5C95B948F4; Sun, 23 Dec 2018 22:40:33 +0100 (CET) Date: Sun, 23 Dec 2018 22:40:30 +0100 Message-ID: <871s67vs4x.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: Donald Eastlake , Babel at IETF In-Reply-To: <87bm5cuhjx.wl-jch@irif.fr> References: <87bm5cuhjx.wl-jch@irif.fr> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Sun, 23 Dec 2018 22:40:30 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Sun, 23 Dec 2018 22:40:32 +0100 (CET) X-Miltered: at korolev with ID 5C2000CE.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C2000D0.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C2000CE.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C2000D0.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C2000CE.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C2000D0.000 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Dec 2018 21:40:40 -0000 >> 7. IANA Considerations >> Has anyone gone to iana so these tlvs can be baked in stone? I just have. IANA #1133140. From nobody Mon Dec 24 04:05:14 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1950F130F11; Mon, 24 Dec 2018 04:05:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Ic9LovPMQvw; Mon, 24 Dec 2018 04:05:11 -0800 (PST) Received: from mail-pf1-x435.google.com (mail-pf1-x435.google.com [IPv6:2607:f8b0:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54F3C12D84C; Mon, 24 Dec 2018 04:05:11 -0800 (PST) Received: by mail-pf1-x435.google.com with SMTP id c123so5744601pfb.0; Mon, 24 Dec 2018 04:05:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=L9hqIQfkSajfPB8d4AJ57AmUeKY1F7GAAPrMiYD51TQ=; b=bgf5ukS0vjELVnYCI8RRiYvBsofcoP0nS/rQAe0FrA4NTB8D6CKpTByVi8qliL4xe2 HutBDad4+CkW1pEJUj6FcTqwhO98p/Wl+2v58QpMqDokbEgw6YRxJarPCcB5+pk+fMxy WiduWLHWqHiTt2/WQF+ISJtcdLq4BAMW7B/UGWtgf7dbdLlmaJYYov4YlPIcSV4hcbXp JlCcfTGvM7Gi0TSSqzp7v23vMAXDfs4jKkk1liOgFezkDt7jm4uW9nrW+WhlgPYlbQ1x LSEaE06fDHm1/D/P+Irr2Z3VYaoeR38MKwEskTav2ETRZm9pI7fUr0LcVn1OCyD7unuS Dvtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=L9hqIQfkSajfPB8d4AJ57AmUeKY1F7GAAPrMiYD51TQ=; b=Cy1SohL5NpNKbTdrBe9J4bJTbKzOC7MHcigUNN0ZnwS1nK+JlY25b3gCGRykSCGYst 6t5m1v2LBLo2ciCx/KX+aq/YFpvmjcu0BagOgMs7uXhqjHykBx6de8HOMwRwn0RpxPTz IO1QLs86Jov1UYdwtE/u0ZhUQGPwpSij1SvRo+2zNX1jeFHPLJFKLM6/X8TRs28o3Hai oKTUxQLlxzsqjlpCsTtFL+LRvutRzaVR31anNuprFMoAVUVMAUR/pwkTx93PpxatrUTS SIVsgMg78X3ewOeLYSNQHUjEprv0uvKcrlqxg2qB1kOMMk9yQAVwzbeK9k29eYIXgdMI TrZQ== X-Gm-Message-State: AJcUuke56VtdrI+khMxYwl1U5Ksn75eNShlMpMAO76G6WFpAaTK6a/qT SwUItKXCISKmmvgKS06b81gcT0LTUi2XPesD63eH4A== X-Google-Smtp-Source: ALg8bN4epq8sN7YzKMS7ht087USD7Ioze3Jc5HoKCzpa5mI2Vcbfgs0vzouo+y0vTGUVCDGBQtKOvLNrgNN/r6msdzU= X-Received: by 2002:a63:7e1a:: with SMTP id z26mr973154pgc.216.1545653110632; Mon, 24 Dec 2018 04:05:10 -0800 (PST) MIME-Version: 1.0 References: <154559998975.4428.5323789975171685208@ietfa.amsl.com> In-Reply-To: <154559998975.4428.5323789975171685208@ietfa.amsl.com> From: David Schinazi Date: Mon, 24 Dec 2018 13:04:09 +0100 Message-ID: To: Babel at IETF Cc: i-d-announce@ietf.org Content-Type: multipart/alternative; boundary="0000000000009af409057dc368d5" Archived-At: Subject: Re: [babel] I-D Action: draft-ietf-babel-hmac-02.txt X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2018 12:05:13 -0000 --0000000000009af409057dc368d5 Content-Type: text/plain; charset="UTF-8" I like the new text. Thanks, David On Sun, Dec 23, 2018 at 10:19 PM wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Babel routing protocol WG of the IETF. > > Title : HMAC authentication for the Babel routing > protocol > Authors : Clara Do > Weronika Kolodziejak > Juliusz Chroboczek > Filename : draft-ietf-babel-hmac-02.txt > Pages : 17 > Date : 2018-12-23 > > Abstract: > This document describes a cryptographic authentication for the Babel > routing protocol that has provisions for replay avoidance. This > document updates RFC 6126bis and obsoletes RFC 7298. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-babel-hmac/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-babel-hmac-02 > https://datatracker.ietf.org/doc/html/draft-ietf-babel-hmac-02 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-babel-hmac-02 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > babel mailing list > babel@ietf.org > https://www.ietf.org/mailman/listinfo/babel > --0000000000009af409057dc368d5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I like the new text.

Thanks,
= David

On Sun, De= c 23, 2018 at 10:19 PM <inte= rnet-drafts@ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Babel routing protocol WG of the IETF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= HMAC authentication for the Babel routing protocol
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Clar= a Do
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Weronika Kolodziejak
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Juliusz Chroboczek
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-babel-hmac-02.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 17
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2018-12-23

Abstract:
=C2=A0 =C2=A0This document describes a cryptographic authentication for the= Babel
=C2=A0 =C2=A0routing protocol that has provisions for replay avoidance.=C2= =A0 This
=C2=A0 =C2=A0document updates RFC 6126bis and obsoletes RFC 7298.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-b= abel-hmac/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-babel-hma= c-02
https://datatracker.ietf.org/doc/html/= draft-ietf-babel-hmac-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=3Ddraf= t-ietf-babel-hmac-02


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
babel mailing list
babel@ietf.org
https://www.ietf.org/mailman/listinfo/babel
--0000000000009af409057dc368d5-- From nobody Mon Dec 24 14:06:41 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55E10129508 for ; Mon, 24 Dec 2018 14:06:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UBDlPd08KecC for ; Mon, 24 Dec 2018 14:06:36 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8B1D12896A for ; Mon, 24 Dec 2018 14:06:36 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1545689192; bh=kUi4MNLw8xQ2vuEUx6GvBNrBoO30gV3xNn2gH2m18uw=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=Cj48jh7x7U0VXLzpL70YxnHVWeSte+WcMbkr1zTrHaI7p/qSw+oOCUlmbugVqJqXY vZkmT9LNnOyA6c1txv1cXyGcNZavkG+R9lSN316fRKMQ4PtjZxzDumG6Z4Yc8OfGNO eoX8rpYyJlnKx18UF8cfiUOw2OBU9xsNrWX0DViTTqGor/7iiVRid48h7tv6NnpiZ1 Z8OW7cUeCxXw/bVekSqzozlE3d1eurVFZStuqjSRx8QLXh+fjfwATUbgJo3due2MXu YAukiroAiBmkkUPQwMjGQ08w4K9pB80286/ri53iaPYN4b5IqefnVkot4sil9RoSpe eRC8c/7EhWRGw== To: Juliusz Chroboczek Cc: Babel at IETF In-Reply-To: <87a7kwuhh1.wl-jch@irif.fr> References: <874lb6hce1.fsf@toke.dk> <87a7kwuhh1.wl-jch@irif.fr> Date: Mon, 24 Dec 2018 23:06:27 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87muouful8.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2018 22:06:40 -0000 Juliusz Chroboczek writes: >> Heh, yeah. Also, my name is spelled with an i, not a y, regardless of >> the encoding ;) > > That changes your position in the alphabetic ordering in the > Acknowledgements section ;-) Woohoo, number one! :D > Fixed, sorry for that. Thanks :) -Toke From nobody Mon Dec 24 14:08:30 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30B91131196 for ; Mon, 24 Dec 2018 14:08:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dyUmE8LWbUY1 for ; Mon, 24 Dec 2018 14:08:28 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 269F012896A for ; Mon, 24 Dec 2018 14:08:28 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1545689305; bh=lb8FjIReddFbhoeQv8FW5Ay1JeLOZJGpdza2Ct6s+uo=; h=From:To:Subject:In-Reply-To:References:Date:From; b=I1wQtVcZORH0ovJigxChSx1v3Ehnqne65AsoF6JfjmuuHAEenHpXyFd69ev/TXAwo ynDXfSlUrGPbQmVQK0Ypiqyg8xA0edc2LnKdrUu4idoeAIyyM0dBCC45IG2gaynJdm KCpYMQWNEHQQnbIQWURtX0Or+IS7xTl0CNjYzDYxnC52hRSeX7eaXt+LixbWSwkvML eiEcKvTOe1byRHNW9INLZ/N8klv+0arwfvSLO4RmVBaig8xR3Twx32anYszkGGXgwx NJgZ7kk1+koEWaWhd15OMtdFh9xm1H7dj+hCgB/6whIT/c/csIdE5Mn6rEBlP6q5Ms QJSQYSedZSdHw== To: David Schinazi , Babel at IETF In-Reply-To: References: <154559998975.4428.5323789975171685208@ietfa.amsl.com> Date: Mon, 24 Dec 2018 23:08:23 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87k1jyfui0.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] I-D Action: draft-ietf-babel-hmac-02.txt X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2018 22:08:29 -0000 David Schinazi writes: > I like the new text. +1 Only one small nit: s/an timeout/a timeout/ -Toke From nobody Mon Dec 24 14:09:06 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 781CB129508 for ; Mon, 24 Dec 2018 14:09:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BeVKTh7p21y4 for ; Mon, 24 Dec 2018 14:09:04 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4530512896A for ; Mon, 24 Dec 2018 14:09:04 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1545689340; bh=Bn/pWev2cS9AfV9cFPfRVR/TDKDhB0oMUMnjKhcFsII=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=MR+SUIODajSAWZrUJW1MbtaeA5d3JqamhepklERMbMGq/CFIV0xcEnre9PU+97Drt mWPFORbHL2pyqfGh7xgcHYhcu++Puy5szY3l9TljfWceBF1sCKNykqwr0a8qkdcy98 I5h7enEotNwl2RNj6QIpm7oWrv+6kwH+fiZd/3CHBa9gnI/ujp3B85fih4v8mR9ers M0o814S+MmcZSUuTekv9draIpxTB2sA7Cu34RIFdMqqhKAjRBywl7wUEoxZisMqqWi YrMq3c6LgpTC/1le73t+e+evy0LcExDB2kFzSe1eNxwHTtiIKOIm5Ta17QhmYB1y4B 0gVKTewx1/uzw== To: Juliusz Chroboczek Cc: Dave Taht , babel-users , Babel at IETF In-Reply-To: <877eg0ugd1.wl-jch@irif.fr> References: <87d0ptle9k.wl-jch@irif.fr> <87va3lfrj4.fsf@toke.dk> <877eg0ugd1.wl-jch@irif.fr> Date: Mon, 24 Dec 2018 23:08:56 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87h8f2fuh3.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] [Babel-users] BASE64 and hex encoding HMAC keys for user presentation X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2018 22:09:05 -0000 Juliusz Chroboczek writes: >>> I think that the HMAC key should be generated automatically. I'd hope >>> that any actual production deployment of HMAC would generate HMAC keys >>> either randomly or by using a suitable KDF (or whatever the right acronym >>> is) and distribute it automatically. > >> Should we pick a KDF? Not necessarily for the RFC, but at least try to >> get compatibility between bird and babeld, so users can just input a >> password and expect things to work? > > I think we might need more deployment experience before we can answer that. > > At this early stage, however, I wouldn't expect the master key to be > distributed -- the KDF would be applied to the master key on a central > node, and the derived secret is what gets distributed to the babeld and > BIRD instances. So having a common syntax for the HMAC secret should be > good enough. Fair enough :) -Toke From nobody Mon Dec 24 14:49:46 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4B021311DA for ; Mon, 24 Dec 2018 14:49:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f1wWkZRf0pmZ for ; Mon, 24 Dec 2018 14:49:42 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F18441311C2 for ; Mon, 24 Dec 2018 14:49:41 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBOMnXh6015701; Mon, 24 Dec 2018 23:49:33 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 7BBCF5B86A; Mon, 24 Dec 2018 23:49:39 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id bFEj35fE-XKf; Mon, 24 Dec 2018 23:49:33 +0100 (CET) Received: from pirx.irif.fr (user-164-126-148-168.play-internet.pl [164.126.148.168]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id A8A135B867; Mon, 24 Dec 2018 23:49:31 +0100 (CET) Date: Mon, 24 Dec 2018 23:49:29 +0100 Message-ID: <87muoua6bq.wl-jch@irif.fr> From: Juliusz Chroboczek To: David Schinazi Cc: Babel at IETF In-Reply-To: References: <154559998975.4428.5323789975171685208@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Mon, 24 Dec 2018 23:49:33 +0100 (CET) X-Miltered: at korolev with ID 5C21627D.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C21627D.001 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C21627D.001 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] I-D Action: draft-ietf-babel-hmac-02.txt X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2018 22:49:45 -0000 > I like the new text. Thanks, David. Let me know if you will do DTLS, or if you want me to. -- Juliusz From nobody Mon Dec 24 14:50:44 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55F621311DB for ; Mon, 24 Dec 2018 14:50:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rrO9SX6NCd0P for ; Mon, 24 Dec 2018 14:50:42 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFA4C1311DA for ; Mon, 24 Dec 2018 14:50:41 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBOMoW4k016118 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 24 Dec 2018 23:50:33 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wBOMoXaZ022315; Mon, 24 Dec 2018 23:50:33 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 9058E5B889; Mon, 24 Dec 2018 23:50:37 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id dpeWc4KO19BM; Mon, 24 Dec 2018 23:50:36 +0100 (CET) Received: from pirx.irif.fr (user-164-126-148-168.play-internet.pl [164.126.148.168]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 458D65B886; Mon, 24 Dec 2018 23:50:35 +0100 (CET) Date: Mon, 24 Dec 2018 23:50:32 +0100 Message-ID: <87lg4ea69z.wl-jch@irif.fr> From: Juliusz Chroboczek To: Toke =?ISO-8859-1?Q?H=F8iland-J=F8rgensen?= Cc: Babel at IETF In-Reply-To: <87k1jyfui0.fsf@toke.dk> References: <154559998975.4428.5323789975171685208@ietfa.amsl.com> <87k1jyfui0.fsf@toke.dk> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Mon, 24 Dec 2018 23:50:33 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Mon, 24 Dec 2018 23:50:34 +0100 (CET) X-Miltered: at korolev with ID 5C2162B8.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C2162B9.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C2162B8.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C2162B9.001 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C2162B8.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C2162B9.001 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] I-D Action: draft-ietf-babel-hmac-02.txt X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2018 22:50:43 -0000 > s/an timeout/a timeout/ Thanks, fixed in git. Merry Christmas to all of you! -- Juliusz From nobody Tue Dec 25 04:44:47 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CB0E130DEE for ; Tue, 25 Dec 2018 04:44:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id flNM8ri8eJBN for ; Tue, 25 Dec 2018 04:44:44 -0800 (PST) Received: from mail-pg1-x534.google.com (mail-pg1-x534.google.com [IPv6:2607:f8b0:4864:20::534]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06E27130DED for ; Tue, 25 Dec 2018 04:44:44 -0800 (PST) Received: by mail-pg1-x534.google.com with SMTP id c25so6545149pgb.4 for ; Tue, 25 Dec 2018 04:44:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+GRbjcSTBFiCym15WiwJNdUee/PkjOe1qB9dp1Rdf9A=; b=hClpdM8BTVACMWmif7JCuiTr7pon+ym/4t8ZHh1ulg6lMbtHQDKeYkE0sIkEu/rggR eGrXnj52pRliRjGKptA1CyiCLAHFdNdwX1EkXCalS77/bftkNUxn4uqlESotOztMKpTh DbFk/9i0qxV3R8OFRv+mjDFHD4B6sl9udp14ZuQc5jW3atShh2s2HloFXzgf3Ei8PXCL Y4jEne6ZVF5F/NgqVc5VVRcCZfrW73TgSFuGemwY2xYDcM4ubdVFTpKFjN7zkuCVi4pc EdRX7MKTzxMY7DmPDb5chv9n3MUH7b2eUU17RbZN3r5LI7L1fidRpXEAn0u/GB+f1ncY WTwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+GRbjcSTBFiCym15WiwJNdUee/PkjOe1qB9dp1Rdf9A=; b=FtpxTjfalNl0lujyvthHV3SbJW/Z5QoCdQqjpYQFKeGvMO77ALAmzwoUg/UhDTQHc8 R5nkBD+Xq1k0t1XuwCnxfCPYebNXRIW0+JSYcwhpXk9TxVON9mlc2fPCAn0YJU7bbYmD DWkND0DS0FVvhifG9Kj2EnpLEks5svVm+KTrZSTdYv/0JvQaGk1XNyXxSlf4MOV50vw0 KmvYvtygkBj/Dg76SQmyAEBVjOELvrqp4RFFQWo2MjPdOhf4rxzk0teSeOBzLZKQ8m8y L0XBgo/AyOzgU5hLaCa/F/HEB17RvUmVQR3/sD+a2abI0l1fIQ+2GDwZcu8L8v7VxA1I s7aQ== X-Gm-Message-State: AJcUukf7PuoZlloKmY/Cc56PSC8FaElOxEdNsCd4wlY9CJ4HK614p1oY OnJp2klXdFOeHEw0YhszVdWqEvAqI3YDPsMlxa9Wjw== X-Google-Smtp-Source: ALg8bN5L9gjmJYpuSupbUGuk1rnqUerfwyaSP3Bsa7oemKwXEVpY78sAuJFAVcrDan8wInVSJZvhpapBYq2atNWzQRA= X-Received: by 2002:a63:4f20:: with SMTP id d32mr15484675pgb.47.1545741883411; Tue, 25 Dec 2018 04:44:43 -0800 (PST) MIME-Version: 1.0 References: <154559998975.4428.5323789975171685208@ietfa.amsl.com> <87muoua6bq.wl-jch@irif.fr> In-Reply-To: <87muoua6bq.wl-jch@irif.fr> From: David Schinazi Date: Tue, 25 Dec 2018 13:44:32 +0100 Message-ID: To: Juliusz Chroboczek Cc: Babel at IETF Content-Type: multipart/alternative; boundary="000000000000e01195057dd813b0" Archived-At: Subject: Re: [babel] I-D Action: draft-ietf-babel-hmac-02.txt X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Dec 2018 12:44:46 -0000 --000000000000e01195057dd813b0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I don=E2=80=99t think I=E2=80=99ll have time during the holidays, but I can= take care of it early January if you=E2=80=99d like. If you have the time I=E2=80=99m happy= for you to take care of it though. David On Mon, Dec 24, 2018 at 23:49 Juliusz Chroboczek wrote: > > I like the new text. > > Thanks, David. Let me know if you will do DTLS, or if you want me to. > > -- Juliusz > --000000000000e01195057dd813b0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I don=E2=80=99t think I=E2=80=99ll have time during = the holidays, but I can take care of it early January if you=E2=80=99d like= . If you have the time I=E2=80=99m happy for you to take care of it though.=

David


= On Mon, Dec 24, 2018 at 23:49 Juliusz Chroboczek <jch@irif.fr> wrote:
> I like the new text.

Thanks, David.=C2=A0 Let me know if you will do DTLS, or if you want me to.=

-- Juliusz
--000000000000e01195057dd813b0-- From nobody Tue Dec 25 14:09:06 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88E3C12785F for ; Tue, 25 Dec 2018 14:09:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iRKF8wzOIlyp for ; Tue, 25 Dec 2018 14:09:03 -0800 (PST) Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFF32123FFD for ; Tue, 25 Dec 2018 14:09:02 -0800 (PST) Received: by mail-qt1-x836.google.com with SMTP id v11so15925812qtc.2 for ; Tue, 25 Dec 2018 14:09:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=YcPv5bkcdo2eKYRPnKCYUVhp/Uyoc+eDFevDfkZQRDQ=; b=VcPGTZojmqYnFaz25sicTMmKWAPRzTGIUmGgN7w1GnSRcJmJN0+k3NzMlImeyZxFWk OGfqyojtVa9d+MdUjcbZTzytT42pUBaAoo/r06gViOyjbH4WYgzZKDQs37GVM0sOyJhb 9D8s1h7IrRkCUMrQTH6BCLuQa4oHM52uEEeH+r6qMwUlJZ1M79y6NuJCY8aT439heIvw SbT0VHaXyQsbG76KULeGxGpKuJUdNtCXusIjSCPPCgGVZDtSeGnPR2dK2WVWv84MfOqL ySCGns3vpvguvowytmUDmT89mGgobx6wdAled87vzmkPe7TCU59a6ZkmaDCki0b4LNHf A55A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=YcPv5bkcdo2eKYRPnKCYUVhp/Uyoc+eDFevDfkZQRDQ=; b=e4P0AvtLdDkWN0y/F4pekcv55LTALEp6UUCESB/lvMHDIOfBULzVdOLKfvUUTXleF0 NkGULLC6XJCWnDl8wQM+Zv8lUvwgsP4Xeu4oksjbis8aOPzKGX7E67XaZZzoSs2t74ks vO5ml2Xk185H0ti6wAkBB0FPCpqr9/TxeV+cc/UwxnnAm4VOeQtpg56oR6zaVaN6T1dJ tjZT16qQ5OG8Rv7kejL1aaDV9g+B8VFIy+K4LmZW5jUfIlXLzbsjsOCcitf5Np+1UDTa A/e+4u19ToX/r6a+TBtONFitwGM8lYeXx38hpZruSPKKrgVQKktNtUPWPGU1q3Cvj+oc RKtA== X-Gm-Message-State: AA+aEWbprf/nDEd6RFkimhqFZn2XKA0bLzUPjyHAiAsMzclAmXskZ9Db eASR1i4BnWqA0+5sd49GLFBkSLUev8yCIprCtKxTYStW X-Google-Smtp-Source: ALg8bN5cqBaTic6kploi+MBSms76UlKSXqf0CgbLj0j6Hz/6vEuPLQSXTNXMha1+cNZB5SxVTfVdxix+yodZ6lpMzt4= X-Received: by 2002:ac8:2e6a:: with SMTP id s39mr16688510qta.355.1545775740867; Tue, 25 Dec 2018 14:09:00 -0800 (PST) MIME-Version: 1.0 From: Dave Taht Date: Tue, 25 Dec 2018 14:08:49 -0800 Message-ID: To: Babel at IETF , babel-users Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: [babel] A Timed Process Algebra for Wireless Networks with an Application in Routing X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Dec 2018 22:09:05 -0000 I thought this was promising in dealing with some of the issues we've had of late. https://arxiv.org/pdf/1606.03663.pdf "In this paper we have proposed T-AWN, a timed process algebra for wireless networks. We are aware that there are many other timed process algebras, such as timed CCS [24], timed CSP [32,28], timed ACP [1], ATP [27] and TPL [17]. However, none of these algebras provides the unique set of features needed for modelling and analysing protocols for wireless networks (e.g. a conditional unicast).15". A couple gems in this paper (otherwise a tough slog) "...In [11] we studied 5184 possible interpretations of the AODV RFC [29], a proliferation due to ambiguities, contradictions and cases of underspecification that could be resolved in multiple ways. In 5006 of these readings of the standard, including some rather plausible ones, we found routing loops, even when excluding all loops that are due to timing issues [16,11]. In [19,11,15] we have chosen a default reading of the RFC that avoids these loops, formalised it in AWN, and formally proved loop freedom, still assuming (implicitly) DELETE PERIOD =3D =E2=88= =9E."" "...It is trivial to find an example where premature route expiration does occur in AODV, and a routing loop ensues. This can happen when a message spends an inordinate amount of time in the queue of incoming messages of a node..." --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 From nobody Tue Dec 25 17:04:37 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10CE5130E63 for ; Tue, 25 Dec 2018 17:04:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.748 X-Spam-Level: X-Spam-Status: No, score=-1.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A6bWjyK64bwU for ; Tue, 25 Dec 2018 17:04:31 -0800 (PST) Received: from mail-it1-x12a.google.com (mail-it1-x12a.google.com [IPv6:2607:f8b0:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11375130E62 for ; Tue, 25 Dec 2018 17:04:31 -0800 (PST) Received: by mail-it1-x12a.google.com with SMTP id x124so24251153itd.1 for ; Tue, 25 Dec 2018 17:04:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=aRZ5ofRnPy3mnBG2oSeKqXPy468X9KWnNdPTbT9N0eY=; b=i4R+ZqQ5pd1aG69qirC/oE7eJ9iOXqRbUvV7AuRtYHGvALNnhA43H6Mej93hkhZufh WXRs3wrNM9gnHI60AP5HO5WYiwycYoqQxkEOLRT54oNKhTQyWOytwmT60PQTNXHdFy+w /F+FyvAsunhmzu5HaDhRYk1X+oqqkzfwJ6QF28cjX3Pd5XHxwrqs8fzfpE7pmgTcet/g OPOhc4DbsjcIzyF5psLDkLHHMuaAlPt3YZ93Id0eVFdAR5TQEuTOb2lZbCjWbTr4t5h/ mIRfwmOE/ZqDs5DzLsTPVQHBxoLDmN+qQ8A+P/l+e7Hm1iIae4anYk0UPtgGBevS1SS+ y24w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=aRZ5ofRnPy3mnBG2oSeKqXPy468X9KWnNdPTbT9N0eY=; b=mwvCHIoX7mHltxLY7HsrzBsfKsmRuA/Ve54Bq9tKbRpsyF0SMpMw5Edp4bMy57sCTG lB7xz2KyvobwCHWVPfZPweuo3LDOSzlOzUGrwHD+3nDDPHEJLIb7RREJqzR20wo6RELC S76/a9KEq+Gd2PcKMQWiMWJpLUwMSLroPv4qnpMHgh2AhraCU4Dk5POpRPekFexqvf2E 8kc891QH2imK9v/u1FTxsUqju9JiOJGFJOOf1vuktt3j7g1NHVG3XH63kMlgAI5SYrrO hTlZdjuB2fgz/Ml3PBWZM2J8RIf4SXwIlXTQDBLEav8b3Rn/KibOcLWEeWCLnpOk9XvV XYqw== X-Gm-Message-State: AA+aEWaouqbItrgmpADif74w/4K6Uuwm3Pzh6xEfeQS3sLEG6zspYySt jg6DBlDT9n5Otp0J6N4fH/25bkxPjcKxOwmHk9U= X-Google-Smtp-Source: ALg8bN7aabb2Kx+cc19NWbKFEZV58CHoPpmk+jWLyg9c8ihIInaFo75ug7dkd2qmicmIPdoWR/AySLxcUbQqGa89MIQ= X-Received: by 2002:a24:6e88:: with SMTP id w130mr10961848itc.103.1545786270210; Tue, 25 Dec 2018 17:04:30 -0800 (PST) MIME-Version: 1.0 References: <87d0ptle9k.wl-jch@irif.fr> <87va3lfrj4.fsf@toke.dk> <877eg0ugd1.wl-jch@irif.fr> <87h8f2fuh3.fsf@toke.dk> In-Reply-To: <87h8f2fuh3.fsf@toke.dk> From: Donald Eastlake Date: Tue, 25 Dec 2018 20:04:18 -0500 Message-ID: To: =?UTF-8?B?VG9rZSBIw7hpbGFuZC1Kw7hyZ2Vuc2Vu?= Cc: Juliusz Chroboczek , Babel at IETF , babel-users Content-Type: multipart/alternative; boundary="00000000000088e28f057de2699c" Archived-At: Subject: Re: [babel] [Babel-users] BASE64 and hex encoding HMAC keys for user presentation X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 01:04:36 -0000 --00000000000088e28f057de2699c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable If you need a KDF, I recommend RFC 5869. Thanks, Donald =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D Donald E. Eastlake 3rd +1-508-333-2270 (cell) 1424 Pro Shop Court, Davenport, FL 33896 USA d3e3e3@gmail.com On Mon, Dec 24, 2018 at 5:09 PM Toke H=C3=B8iland-J=C3=B8rgensen wrote: > Juliusz Chroboczek writes: > > >>> I think that the HMAC key should be generated automatically. I'd hop= e > >>> that any actual production deployment of HMAC would generate HMAC key= s > >>> either randomly or by using a suitable KDF (or whatever the right > acronym > >>> is) and distribute it automatically. > > > >> Should we pick a KDF? Not necessarily for the RFC, but at least try to > >> get compatibility between bird and babeld, so users can just input a > >> password and expect things to work? > > > > I think we might need more deployment experience before we can answer > that. > > > > At this early stage, however, I wouldn't expect the master key to be > > distributed -- the KDF would be applied to the master key on a central > > node, and the derived secret is what gets distributed to the babeld and > > BIRD instances. So having a common syntax for the HMAC secret should b= e > > good enough. > > Fair enough :) > > -Toke > > _______________________________________________ > Babel-users mailing list > Babel-users@alioth-lists.debian.net > https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/babel-users --00000000000088e28f057de2699c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
If you need a KDF, I recommend RFC 5869.

Thanks,
Donald
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=C2=A0Donald E. E= astlake 3rd =C2=A0 +1-508-333-2270 (cell)
=C2=A01424 Pro Shop Court, Dav= enport, FL 33896 USA
=C2=A0d3e3e3@gmail.com


On Mon, Dec 24, 2018 at 5:09 PM Toke H=C3=B8i= land-J=C3=B8rgensen <toke@toke.dk>= ; wrote:
Juliusz= Chroboczek <jch@irif.f= r> writes:

>>> I think that the HMAC key should be generated automatically.= =C2=A0 I'd hope
>>> that any actual production deployment of HMAC would generate H= MAC keys
>>> either randomly or by using a suitable KDF (or whatever the ri= ght acronym
>>> is) and distribute it automatically.
>
>> Should we pick a KDF? Not necessarily for the RFC, but at least tr= y to
>> get compatibility between bird and babeld, so users can just input= a
>> password and expect things to work?
>
> I think we might need more deployment experience before we can answer = that.
>
> At this early stage, however, I wouldn't expect the master key to = be
> distributed -- the KDF would be applied to the master key on a central=
> node, and the derived secret is what gets distributed to the babeld an= d
> BIRD instances.=C2=A0 So having a common syntax for the HMAC secret sh= ould be
> good enough.

Fair enough :)

-Toke

_______________________________________________
Babel-users mailing list
Ba= bel-users@alioth-lists.debian.net
https://alioth-lists.debian.net/= cgi-bin/mailman/listinfo/babel-users
--00000000000088e28f057de2699c-- From nobody Tue Dec 25 20:06:13 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78BAD12950A for ; Tue, 25 Dec 2018 20:06:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LLz4PEPdhd33 for ; Tue, 25 Dec 2018 20:06:07 -0800 (PST) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F23B128B01 for ; Tue, 25 Dec 2018 20:06:07 -0800 (PST) Received: by mail-io1-xd31.google.com with SMTP id p7so646377iog.12 for ; Tue, 25 Dec 2018 20:06:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6VPd1zUyD86IJua20SJOza6hHzBiTEBj1kQBL2HLxhU=; b=JjokREA2ryHnSkiiZa3bQMhjZLWaoPpeJ/9ja9tOQEYHKSN9wNeYinDvKqDhfmm9pr UIiUxB3qxRPLCOwLUKe4nKFAl7LWgNpLNegCv6Wuuoh0OyG/kWODn0sE2iLK8DQCpB3n 56gObAHNCGFoCPSTv5YYv5l24gHkXgI1XL/JYb0+jZkToxkkAVR0ZShZjqDVY7mrFR0f ovZsr6wazI9w5TUoU0UTMNAFhZvZdFLHW/diocHKnGb+kueWVj76lMKiAEgK8IYoluyP Vdq8bEmc9Ux2X91d+rIzb8rDgRwxJryCW33pqseoPnExTfgsRhnRpunIdwEV80OSPdSt GNMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6VPd1zUyD86IJua20SJOza6hHzBiTEBj1kQBL2HLxhU=; b=f5U5Ss6Y8pLuk7zZJEkhUCFCS+2JfcwKAZLB2zf9r6UotS4rS3OygOTeATyy8SjTLY I8lBm61lT/TUBNE7SmBClPWaaGRYjH6q+5Qt0MVioNDejGV3fi0pL651YV7jyz10VuRl P/ayXmO2NX0+KYH2eekJFShytINaR5wMjKByv2gGaFi/qHi4z+TLnoz2Sl3SyLQhy8ih dtPxOqpMdc/Rby22YNcw/gYyzohpyJK7hdS5sBwgBYdPMdqE3c1xRmgzHjxHEl36XpFo ENmTbiAKBuenKdqbf4B1GBe4o1ZNFNKVIN5/RulqhCxVtu3/NG2Z5UHnTRXIQWYsWf8A cXyQ== X-Gm-Message-State: AJcUukdvs0fiUFFQVxrQ1dxXT7yOhoPeRzVmW4qdQ1xj370KoeEju1fQ P+FSM0B3PyHofTXHWDIo89SDzhOqIN6WixajYLM= X-Google-Smtp-Source: ALg8bN537B22G/4yTpBN2xfkV0jybnT6wnwtqTWaIRZp0nArEhgzYzACnIzeD0IfS6ZWviVW+KXrspSWUk1nvY0qYOw= X-Received: by 2002:a6b:e919:: with SMTP id u25mr12789146iof.132.1545797166356; Tue, 25 Dec 2018 20:06:06 -0800 (PST) MIME-Version: 1.0 References: <87bm5cuhjx.wl-jch@irif.fr> <871s67vs4x.wl-jch@irif.fr> In-Reply-To: <871s67vs4x.wl-jch@irif.fr> From: Donald Eastlake Date: Tue, 25 Dec 2018 23:05:55 -0500 Message-ID: To: Juliusz Chroboczek Cc: Dave Taht , Babel at IETF Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 04:06:11 -0000 The TLV Type code point have been approved and should get allocated soon. Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 1424 Pro Shop Court, Davenport, FL 33896 USA d3e3e3@gmail.com On Sun, Dec 23, 2018 at 4:40 PM Juliusz Chroboczek wrote: > > >> 7. IANA Considerations > > >> Has anyone gone to iana so these tlvs can be baked in stone? > > I just have. IANA #1133140. From nobody Tue Dec 25 20:32:19 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAA94130F41; Tue, 25 Dec 2018 20:32:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HfYdT3k34EIr; Tue, 25 Dec 2018 20:32:17 -0800 (PST) Received: from mail-it1-x12d.google.com (mail-it1-x12d.google.com [IPv6:2607:f8b0:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3719F130F4C; Tue, 25 Dec 2018 20:32:15 -0800 (PST) Received: by mail-it1-x12d.google.com with SMTP id g76so19737323itg.2; Tue, 25 Dec 2018 20:32:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=0ZFCl0RKSmuOaTgEU+x0ul1gkOanA7fxHJo2fvGRoL4=; b=qbownFSnFOv5szfTU9hnb+B4dihLcWKV6j256vThtF49wrv4V/UU7ikBALO+jH+U0B uuPO+7J3MbZsoaygwEAIZYFDUTU28yGUv1wmVXoD/bc8Bj/FttnDDEzgoKLfGpxgtBOh 8rcwYYbMKrB+0+sFeYD6KNtnEEBysatNuIqE2xzdhBoTGRMGsCdDnkvlKmRDtJSQF2aD dtxFcXRfWhz550v2oj0ajQKd+aEPKBTEzHQjMVU5xSSMul9LzITsmC0b4tRAKwlErviu E0435Tj0zOowrwtuWc7wHjCDBs0Xmf2oWQFCHr2xoByFwH72MCsm7uEwAMxB7WaFDoX7 n/hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=0ZFCl0RKSmuOaTgEU+x0ul1gkOanA7fxHJo2fvGRoL4=; b=a2HfHEhekbUqPazLxvYVQO7uxxXJcTYVPx4BV9vWpNtWzsm4rjGUTusBJzWpeKBmcQ DpzXyjfseVSvSKubT/zwNovS7LArszh+XWRvP3eQARc6ycBR4zMQpjLPNDyH2QNEkDU4 Q1J2lClnH7AI/ELHrOZEw8oacW8DvmIwzjaZ5eIa9ywQu/Hljz1hOIBaxns336GQRvjB mV1x+mWHqM5DYjhwQg4cdY3ggXiJgyv4lDqkbSsFpyEeGNbCBQ/uGeolktwQO69/pBVn TqLHfklLDr+th58/TV3WcpLIVnqHsyx5uKAEjfCAPE3rlaz5PmuU6AiHGEOLrdEgPT6T EDlw== X-Gm-Message-State: AA+aEWbbzp5jye9HRdbEYdALGxrFpm6SYjfYdk5CzjzzJVtTuhBlMVzl QmfbjV9IR6ylFf0VdOMlGMZ4iMWlAxQqL+Z8wqkytbt6 X-Google-Smtp-Source: AFSGD/UskcbcRWC7abmL1f+eLRhExmqdpwXVaoi0ft5d22RfzxlD+pnTipkjfqfjDjuBfy3VxExtmNyKHww8shAp6FU= X-Received: by 2002:a24:89:: with SMTP id 131mr11105529ita.105.1545798734315; Tue, 25 Dec 2018 20:32:14 -0800 (PST) MIME-Version: 1.0 From: Donald Eastlake Date: Tue, 25 Dec 2018 23:32:03 -0500 Message-ID: To: Babel at IETF Cc: babel-chairs , draft-ietf-babel-hmac@ietf.org Content-Type: multipart/alternative; boundary="0000000000007407a2057de550a2" Archived-At: Subject: [babel] Shepherd's review of draft-ietf-babel-hmac-02 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 04:32:19 -0000 --0000000000007407a2057de550a2 Content-Type: text/plain; charset="UTF-8" Section 1.2, Bottom of page 3. "robust random number generator" -> "robust random number [RFC4086] generator". Could also add the RFC 4086 reference at other occurrences of "random" but reference should be included at least once. Section 1.2, Top of page 4, third bullet item. This is a little confusing to read. I assume that the point about the packet being accepted by node A is that it's a valid packet (has a good HMAC TLV). But I think the average reading will be wondering "What is this node A and why isn't it mentioned again later?" Not sure if there is a reasonable wording change that improves this... Section 5.2: The diagram is odd. I would recommend sliding the Index field and preceding vertical bar character to the left so it starts aligned with the Type. Also, the PC is fixed length, which is not shown in the figure - I think you really have to at least mention the length of the PC in this section. Perhaps best to change the figure to something like the following: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PC | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Index... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- or +-----------+ | Type | 1 byte +-----------+ | Length | 1 byte +-----------+-----------+-----------+-----------+ | PC | 4 bytes +-----------+-----------+-----------+-----------+ | Index... variable +-----------+-----------+-----------+-----... While it is reasonable, for implementation convenience, that there is a maximum size for Index, perhaps for cryptographic strength, there should be a minimum length, maybe 12 bytes? Thinking some more about PC, seems like you either (1) need to say that circular arithmetic is used [rfc1982] (bad idea in my opinion), or (2) say what happens when PC hits all 1's (presumably adopt a new Index, probably a better idea). It might be useful to also state that PC is an "unsigned integer" or the like. Section 7. Should say IANA is "requested" rather than "instructed". (Or, after the number are allocated, should be re-worded to indicated that the IANA actions have been completed.) Appendix B.2. Heading should end with "-hmac-01", not "-hman-00". Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 1424 Pro Shop Court, Davenport, FL 33896 USA d3e3e3@gmail.com --0000000000007407a2057de550a2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Section 1.2, Bottom of page 3.
"robust random numb= er generator" -> "robust random number [RFC4086]
generator&= quot;. Could also add the RFC 4086 reference at other occurrences
of &qu= ot;random" but reference should be included at least once.

Sect= ion 1.2, Top of page 4, third bullet item.
This is a little confusing to= read. I assume that the point about the
packet being accepted by node A= is that it's a valid packet (has a
good HMAC TLV). But I think the = average reading will be wondering
"What is this node A and why isn&= #39;t it mentioned again later?" Not sure
if there is a reasonable = wording change that improves this...

Section 5.2:
The diagram is = odd. I would recommend sliding the Index field and
preceding vertical ba= r character to the left so it starts aligned
with the Type. Also, the PC= is fixed length, which is not shown in the
figure - I think you really = have to at least mention the length of the
PC in this section. Perhaps b= est to change the figure to something
like the following:
=C2=A0 =C2=A0 0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 1 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 2 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 3
=C2=A0 =C2=A0 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2= 3 4 5 6 7 8 9 0 1
=C2=A0 =C2=A0+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
=C2= =A0 =C2=A0| =C2=A0 =C2=A0 Type =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0Length = =C2=A0 =C2=A0 |
=C2=A0 =C2=A0+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+= -+-+-+-+-+-+-+-+-+-+-+
=C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 PC =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0 =C2=A0+-+-+-+-+-+-+-+-+-+-+-+-+-= +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
=C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0Index...
=C2=A0 =C2=A0+-+-+-+-+-+-+-+-+-+-+-+-+-= +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
or
=C2=A0 =C2=A0+-----------+
=C2=A0 =C2=A0| =C2=A0 =C2=A0Type = =C2=A0 | =C2=A0 =C2=A0 =C2=A0 =C2=A0 1 byte
=C2=A0 =C2=A0+-----------+=C2=A0 =C2=A0| =C2=A0 Length =C2=A0| =C2=A0 =C2=A0 =C2=A0 =C2=A0 1 byte=C2=A0 =C2=A0+-----------+-----------+-----------+-----------+
=C2=A0 = =C2=A0| =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0PC =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 | =C2=A04 bytes
=C2=A0 =C2=A0+-----------+-----------+---= --------+-----------+
=C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0Index... =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0variable
=C2=A0 =C2=A0+----= -------+-----------+-----------+-----...

While it is reasonab= le, for implementation convenience, that there is
a maximum size for Ind= ex, perhaps for cryptographic strength, there
should be a minimum length= , maybe 12 bytes?

Thinking some more about PC, seems like you either= (1) need to say
that circular arithmetic is used [rfc1982] (bad idea in= my opinion),
or (2) say what happens when PC hits all 1's (presumab= ly adopt a new
Index, probably a better idea). It might be useful to als= o state that
PC is an "unsigned integer" or the like.

S= ection 7.
Should say IANA is "requested" rather than "ins= tructed". (Or, after
the number are allocated, should be re-worded = to indicated that the
IANA actions have been completed.)

Appendix= B.2.
Heading should end with "-hmac-01", not "-hman-00&q= uot;.

Thanks,
Donald
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=C2=A0Donald E. E= astlake 3rd =C2=A0 +1-508-333-2270 (cell)
=C2=A01424 Pro Shop Court, Dav= enport, FL 33896 USA
=C2=A0d3e3e3@gm= ail.com
--0000000000007407a2057de550a2-- From nobody Tue Dec 25 20:36:34 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8E33130F47 for ; Tue, 25 Dec 2018 20:36:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tYpDscGgOIGa for ; Tue, 25 Dec 2018 20:36:27 -0800 (PST) Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB295130F43 for ; Tue, 25 Dec 2018 20:36:27 -0800 (PST) Received: by mail-qt1-x836.google.com with SMTP id t33so16352134qtt.4 for ; Tue, 25 Dec 2018 20:36:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=NGpYgMYXDBJIeUOakOaIZOXQHEHTs9qoSNnM3FaDLVo=; b=j/T7bPVNqiTmvgKeS9REB1JXtJ7ubnR/chhfdiz70+9g5pPcktOyBipBFYIIWS8I4W XJf5BVgYIV8XuplnlMrNb0hHXieLlKOcDBYMZGJUnLriCAI5JDJ4iKmbmS/qdDIc8VSY dm/l9050PapYVwJHhnN3EXyz5brkWH+hxa9ZtjPzvMC+1XKHckE5IhwjDNoUj5/2aJDt ZP7dzbhinPe7xgdv6OV2KljJRXDLJvkfIuLkxkbQzDRFTt+nbaOoAgn/XKrpmpF2o95N 448QbIW/I+jmSAf/cl7F26G64PlRO++wfhn3vl+XckLOkd3TBfkc2Rx19SaKC2shYQYa kpZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=NGpYgMYXDBJIeUOakOaIZOXQHEHTs9qoSNnM3FaDLVo=; b=WjwT190YwZCLCZ8dv2NpAWvR9rMEK+ciSoDJZRUJx5DYq135Amigg+guY5i20sv71W ZLgkl9ogrdnnJhkZADHdwYejBKk3/CkzcpptH15QGFrfRjVfwG0ISKFLGMII/gX1pCt6 MCtGI/ifQ16vbhb82dNzBmaVJfbeC95cyPX+ivkr3m2hbUvcld52VV8LimWH0SqaoYjD DirqgIKa8Qa5GjzNaipUs+QWRGLcfZ15/5KMGTpvzI5GF3argxK14gEFdtZgxflanWGz 0csYLMFS6xK0q22aJB20S9UvVE8lEV3x8Rx4QpZ+KwWc4NK+Zp+g6TWR5UEk1PjsQO+y gASQ== X-Gm-Message-State: AA+aEWYoy1edquLFqcRh2PmZR1X+LZWlrVY4rHRpjbTyL9IPLh1MOgL/ ALPKYK30L76/hqCM5+QuXqhn2MBLGD36YqfXU5A= X-Google-Smtp-Source: ALg8bN7HlVMNYs5pdSP9JRVKTlQrpR37fUw0CFHEuevjlaFBhY5kkUyoXlwif6NPe5qeQjc8wKaHt8AyDw/IRwh1JuQ= X-Received: by 2002:ac8:5314:: with SMTP id t20mr16818364qtn.328.1545798986640; Tue, 25 Dec 2018 20:36:26 -0800 (PST) MIME-Version: 1.0 References: <874lb6hce1.fsf@toke.dk> <87a7kwuhh1.wl-jch@irif.fr> <87muouful8.fsf@toke.dk> In-Reply-To: <87muouful8.fsf@toke.dk> From: Dave Taht Date: Tue, 25 Dec 2018 20:36:20 -0800 Message-ID: To: =?UTF-8?B?VG9rZSBIw7hpbGFuZC1Kw7hyZ2Vuc2Vu?= Cc: Juliusz Chroboczek , Babel at IETF Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [babel] WG Last Call on draft-ietf-babel-hmac X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 04:36:33 -0000 On Mon, Dec 24, 2018 at 2:06 PM Toke H=C3=B8iland-J=C3=B8rgensen wrote: > > Juliusz Chroboczek writes: > > >> Heh, yeah. Also, my name is spelled with an i, not a y, regardless of > >> the encoding ;) > > > > That changes your position in the alphabetic ordering in the > > Acknowledgements section ;-) > > Woohoo, number one! :D I was actually serious about the utf-8 thing. As it's been 15 years since utf-8 became an internet standard (https://tools.ietf.org/html/rfc3629) it would be nice if internet standards could be written in utf-8. When last I checked on this, 5 years back, tools were "almost" ready. -- Dave T=C3=A4ht From nobody Tue Dec 25 21:19:04 2018 Return-Path: X-Original-To: babel@ietf.org Delivered-To: babel@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B3B812F1A2; Tue, 25 Dec 2018 21:19:02 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Donald Eastlake To: X-Test-IDTracker: no X-IETF-IDTracker: 6.89.2 Auto-Submitted: auto-generated Precedence: bulk Cc: babel-chairs@ietf.org, d3e3e3@gmail.com, iesg-secretary@ietf.org, Donald Eastlake , babel@ietf.org Message-ID: <154580154204.23948.5085982265708278683.idtracker@ietfa.amsl.com> Date: Tue, 25 Dec 2018 21:19:02 -0800 Archived-At: Subject: [babel] Publication has been requested for draft-ietf-babel-applicability-05 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 05:19:02 -0000 Donald Eastlake has requested publication of draft-ietf-babel-applicability-05 as Informational on behalf of the BABEL working group. Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-babel-applicability/ From nobody Wed Dec 26 11:03:26 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAD501311FE; Wed, 26 Dec 2018 11:03:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MJKctgc_jUkA; Wed, 26 Dec 2018 11:03:22 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD1391311B7; Wed, 26 Dec 2018 11:03:21 -0800 (PST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBQJ3DXJ017994 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 26 Dec 2018 20:03:13 +0100 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id wBQJ3ExC000942; Wed, 26 Dec 2018 20:03:14 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 6EB538AD82; Wed, 26 Dec 2018 20:03:18 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id P19vQ4pkbGiI; Wed, 26 Dec 2018 20:03:16 +0100 (CET) Received: from pirx.irif.fr (user-46-112-163-217.play-internet.pl [46.112.163.217]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 787A58AD7C; Wed, 26 Dec 2018 20:03:13 +0100 (CET) Date: Wed, 26 Dec 2018 20:03:12 +0100 Message-ID: <87ftuk9klr.wl-jch@irif.fr> From: Juliusz Chroboczek To: Donald Eastlake Cc: Babel at IETF , babel-chairs , draft-ietf-babel-hmac@ietf.org In-Reply-To: References: User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Wed, 26 Dec 2018 20:03:13 +0100 (CET) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Wed, 26 Dec 2018 20:03:15 +0100 (CET) X-Miltered: at korolev with ID 5C23D071.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 5C23D072.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C23D071.001 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 5C23D072.001 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C23D071.001 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 5C23D072.001 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] Shepherd's review of draft-ietf-babel-hmac-02 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 19:03:25 -0000 Thanks for your review, Donald. > "robust random number generator" -> "robust random number [RFC4086] > generator". Could also add the RFC 4086 reference at other occurrences > of "random" but reference should be included at least once. Done, thanks. > Section 1.2, Top of page 4, third bullet item. > This is a little confusing to read. I assume that the point about the > packet being accepted by node A is that it's a valid packet (has a > good HMAC TLV). But I think the average reading will be wondering > "What is this node A and why isn't it mentioned again later?" Not sure > if there is a reasonable wording change that improves this... I too am unhappy with this property. We've spent a lot of time thinking about how to reformulate it in a more comprehensible manner, but we've failed. If anyone has any idea, I'm listening. > Section 5.2: > The diagram is odd. I would recommend sliding the Index field and > preceding vertical bar character to the left so it starts aligned > with the Type. I've tried, but I didn't like the result. I'll leave it as it is, if that's okay with you. > Also, the PC is fixed length, which is not shown in the figure - I think > you really have to at least mention the length of the PC in this > section. Done. > While it is reasonable, for implementation convenience, that there is > a maximum size for Index, perhaps for cryptographic strength, there > should be a minimum length, maybe 12 bytes? I disagree. The only property that the index needs to satisfy is that it is never reused for a different PC sequence for a given (key, sender) pair. In particular, if a node never loses state (e.g. it has reliable persistent storage), then it never needs to change indices -- and in that case, a 0-octet index is suitable. > Thinking some more about PC, seems like you either (1) need to say > that circular arithmetic is used [rfc1982] (bad idea in my opinion), > or (2) say what happens when PC hits all 1's (presumably adopt a new > Index, probably a better idea). It might be useful to also state that > PC is an "unsigned integer" or the like. In Section 4.2, we say: if the PC overflows, a new index is generated; In Section 5.2, we say: A new index MUST be generated whenever the PC overflows. Please let me know if you think that's not explicit enough. > Should say IANA is "requested" rather than "instructed". Done. > Heading should end with "-hmac-01", not "-hman-00". Done. Thanks again, -- Juliusz From nobody Wed Dec 26 11:13:03 2018 Return-Path: X-Original-To: babel@ietf.org Delivered-To: babel@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 42A3D1311FD; Wed, 26 Dec 2018 11:12:57 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: babel@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.89.2 Auto-Submitted: auto-generated Precedence: bulk Reply-To: babel@ietf.org Message-ID: <154585157723.9615.4468501718555826387@ietfa.amsl.com> Date: Wed, 26 Dec 2018 11:12:57 -0800 Archived-At: Subject: [babel] I-D Action: draft-ietf-babel-hmac-03.txt X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 19:12:57 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Babel routing protocol WG of the IETF. Title : HMAC authentication for the Babel routing protocol Authors : Clara Do Weronika Kolodziejak Juliusz Chroboczek Filename : draft-ietf-babel-hmac-03.txt Pages : 17 Date : 2018-12-26 Abstract: This document describes a cryptographic authentication mechanism for the Babel routing protocol that has provisions for replay avoidance. This document updates RFC 6126bis and obsoletes RFC 7298. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-babel-hmac/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-babel-hmac-03 https://datatracker.ietf.org/doc/html/draft-ietf-babel-hmac-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-babel-hmac-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Dec 26 12:37:06 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77E55131316; Wed, 26 Dec 2018 12:37:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OcFfoFnU4xBW; Wed, 26 Dec 2018 12:37:02 -0800 (PST) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4647113130A; Wed, 26 Dec 2018 12:37:02 -0800 (PST) Received: by mail-qt1-x82f.google.com with SMTP id v11so18366482qtc.2; Wed, 26 Dec 2018 12:37:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=oYx1fTRVnGeIajqqSyKAli8o+1MXac0EPPxZjy6Mid8=; b=Z+I7VZaphmTJh8kcGg+qs+61cYtgLSIk1fQlVIxdSZd0my6fdA7BGPVOz8xzFSS2xO sc62rBvYiY3CrcrgVvsIOMnx7lML+Ktn63TDTb/nNv5WV7eWM/g4aOVdCaaTmKFmiS4j lLQWW9BFmwInpfhAGhoW7Ot1tRBLylpHAl/mClywrak391P3RW6tDb/dvJnCNSWEc+Jn EShnoQHpOep8eU4yWBzC4LKO7NI2aYeAO87BYjTFCreViwmowh43AzryTqmXBJ4P5Cea eIY5ndsC/3BEoiIQLuTwhoPZIKL4/vjaKMDTr4wUvPFVpFyauFY3Fvyq4z1D4UUWT2MF qPGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=oYx1fTRVnGeIajqqSyKAli8o+1MXac0EPPxZjy6Mid8=; b=X7mWg3EHMBTmBFEbrYnBCvugy/cd0alwM7R4tuXdClIKSlVEcjjKeoRKn+ysESFxYj 2NqLhSvvSS6i1agxttK0ZATgk7xTGHvEIDsjMssz6CjFq891cv5qa/yxgUymUUCJ9eYS CsxL2KQd+bAeC8qVXFYDAAS9BjE1aAjSH6kPlDPTMZCDaiC/mIKdoqxlPRYrRB32ol+Q lablrQX1QRBG+K6CHUbWhVnd7Sglt1orRegYkVsvHkrYyvWR0E/i2RtAEr5NljFMZlSF n/ytij+P5oFPcFAiy6ME+7KK5FWSD39rQbzVzo84jl0mekm1u/aPh+dX4/2y8Qi120ip ugqw== X-Gm-Message-State: AA+aEWav5LtDt8EX6zcyHMgN1em/Mj/O67cJOhi98ZyYtJd5Omx/tJzY mzG/f4Wb8nhoR2qBx9tGnDUyQnerWMwymhwLGYE= X-Google-Smtp-Source: ALg8bN5+InrWNXHZXnO/Jf43aLPfkFRqIcx495UcMNhIyCTEydaWBbv8x851/kEe4MN9kmimlMl5KMABcHqWmn+vpzw= X-Received: by 2002:ac8:5314:: with SMTP id t20mr19387994qtn.328.1545856621118; Wed, 26 Dec 2018 12:37:01 -0800 (PST) MIME-Version: 1.0 References: <87ftuk9klr.wl-jch@irif.fr> In-Reply-To: <87ftuk9klr.wl-jch@irif.fr> From: Dave Taht Date: Wed, 26 Dec 2018 12:36:48 -0800 Message-ID: To: Juliusz Chroboczek Cc: Donald Eastlake , babel-chairs , Babel at IETF , draft-ietf-babel-hmac@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [babel] Shepherd's review of draft-ietf-babel-hmac-02 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 20:37:05 -0000 On Wed, Dec 26, 2018 at 11:03 AM Juliusz Chroboczek wrote: > > Thanks for your review, Donald. > > > "robust random number generator" -> "robust random number [RFC4086] > > generator". Could also add the RFC 4086 reference at other occurrences > > of "random" but reference should be included at least once. > > Done, thanks. > > > Section 1.2, Top of page 4, third bullet item. > > This is a little confusing to read. I assume that the point about the > > packet being accepted by node A is that it's a valid packet (has a > > good HMAC TLV). But I think the average reading will be wondering > > "What is this node A and why isn't it mentioned again later?" Not sure > > if there is a reasonable wording change that improves this... > > I too am unhappy with this property. We've spent a lot of time thinking > about how to reformulate it in a more comprehensible manner, but we've > failed. If anyone has any idea, I'm listening. I'll think upon it too. > > > Section 5.2: > > The diagram is odd. I would recommend sliding the Index field and > > preceding vertical bar character to the left so it starts aligned > > with the Type. > > I've tried, but I didn't like the result. I'll leave it as it is, if > that's okay with you. > > > Also, the PC is fixed length, which is not shown in the figure - I thin= k > > you really have to at least mention the length of the PC in this > > section. > > Done. > > > While it is reasonable, for implementation convenience, that there is > > a maximum size for Index, perhaps for cryptographic strength, there > > should be a minimum length, maybe 12 bytes? > > I disagree. The only property that the index needs to satisfy is that it > is never reused for a different PC sequence for a given (key, sender) > pair. In particular, if a node never loses state (e.g. it has reliable > persistent storage), then it never needs to change indices -- and in that > case, a 0-octet index is suitable. Well, say that in the draft. It's come up as a gut objection in everybody thus far. > > Thinking some more about PC, seems like you either (1) need to say > > that circular arithmetic is used [rfc1982] (bad idea in my opinion), > > or (2) say what happens when PC hits all 1's (presumably adopt a new > > Index, probably a better idea). It might be useful to also state that > > PC is an "unsigned integer" or the like. > > In Section 4.2, we say: > > if the PC overflows, a new index is generated; When. You used an example of several hundred years, but I think that was dependent on the current default 4 sec hello interval? I'm still working out how to go about attacking things. One way is to force the daemon to crash (malformed packet, a ping of death, some other vulnerability in another daemon that can send a kill -9 to this process), on restart, which resets the pc, and forces choosing a new index. With a zero length index, well... > > In Section 5.2, we say: > > A new index MUST be generated whenever the PC overflows. > > Please let me know if you think that's not explicit enough. > > > Should say IANA is "requested" rather than "instructed". > > Done. > > > Heading should end with "-hmac-01", not "-hman-00". > > Done. > > Thanks again, > > -- Juliusz > > _______________________________________________ > babel mailing list > babel@ietf.org > https://www.ietf.org/mailman/listinfo/babel --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740 From nobody Wed Dec 26 14:17:26 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8BB713135C; Wed, 26 Dec 2018 14:17:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wuK3CqAUyoq9; Wed, 26 Dec 2018 14:17:22 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3DBE2130E1A; Wed, 26 Dec 2018 14:17:22 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBQMHDU5021736; Wed, 26 Dec 2018 23:17:13 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id B41F88C3EC; Wed, 26 Dec 2018 23:17:19 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id iVt3doC-nMQb; Wed, 26 Dec 2018 23:17:17 +0100 (CET) Received: from pirx.irif.fr (user-46-112-163-217.play-internet.pl [46.112.163.217]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 49FBE8C3EA; Wed, 26 Dec 2018 23:17:16 +0100 (CET) Date: Wed, 26 Dec 2018 23:17:14 +0100 Message-ID: <87a7ks9bmd.wl-jch@irif.fr> From: Juliusz Chroboczek To: Dave Taht Cc: Donald Eastlake , babel-chairs , Babel at IETF , draft-ietf-babel-hmac@ietf.org In-Reply-To: References: <87ftuk9klr.wl-jch@irif.fr> User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Wed, 26 Dec 2018 23:17:13 +0100 (CET) X-Miltered: at korolev with ID 5C23FDE9.001 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C23FDE9.001 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C23FDE9.001 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] Shepherd's review of draft-ietf-babel-hmac-02 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Dec 2018 22:17:25 -0000 >> I disagree. The only property that the index needs to satisfy is that it >> is never reused for a different PC sequence for a given (key, sender) >> pair. In particular, if a node never loses state (e.g. it has reliable >> persistent storage), then it never needs to change indices -- and in that >> case, a 0-octet index is suitable. > Well, say that in the draft. It's come up as a gut objection in > everybody thus far. =46rom Section 6: Second, it assumes that indices and nonces are generated uniquely over the lifetime of a key used for HMAC computation (more precisely, indices must be unique for a given (key, source) pair, and nonces must be unique for a given (key, source, destination) triple). This property can be satisfied either by using a cryptographically secure random number generator to generate indices and nonces that contain enough entropy (64-bit values are believed to be large enough for all practical applications), or by using a reliably monotonic hardware clock. If unicity cannot be guaranteed (e.g., because a hardware clock has been reset), then rekeying is necessary. > I'm still working out how to go about attacking things. One way is to > force the daemon to crash (malformed packet, a ping of death, some > other vulnerability in another daemon that can send a kill -9 to this > process), on restart, which resets the pc, and forces choosing a new > index. With a zero length index, well... You detect that you've suffered a crash, and you refuse to run until you detect a key rotation. Or you detect that you've suffered a crash, and switch to 64-bit indices until the next key rotation. I'm not saying that that's the right way to implement this protocol (it's too complex and fragile for my taste), but if someone is intent on saving every extra bit on the wire, the protocol allows that. -- Juliusz From nobody Wed Dec 26 21:23:51 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14449128B01; Wed, 26 Dec 2018 21:23:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wm5wQ3Yjl9O7; Wed, 26 Dec 2018 21:23:44 -0800 (PST) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D57812894E; Wed, 26 Dec 2018 21:23:44 -0800 (PST) Received: by mail-io1-xd31.google.com with SMTP id r200so13706309iod.11; Wed, 26 Dec 2018 21:23:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8M54/dJqvKpk7zrktjwvOaN5KSBVIeM3c/EWNfAaLSY=; b=Zv23wgMnUwfnfqL5laLPIsmE/CEHn4u2P+fC2jpyTmfCT8I11RfGtKYbpsPUd9lScy rVsvzdH1QBRjSRY6AeecM+shp5/aMavwMVibAnfuoyjXtanlTIiyMp2/ziT3YX0QpWx2 VjXK9PorHHQ3MoXeNf6LmdctTRw0NU8iTx1nIO1tX8dm2x1YMHxUGPfl46AP+JIBopTT un50HV0vJfFQBKbgBWBhFx2Ku6Cfc8LCUa/8HIp8IN/diccuJP0aXCOtCsYtGAxBDB2o BTOf2kGWzZTD6YQtmIOshY52QhOkzgOMf6b+cpC1zeZvDtwRI9/AVsDMNRMx/JJIrIM9 q9Ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8M54/dJqvKpk7zrktjwvOaN5KSBVIeM3c/EWNfAaLSY=; b=Mt3t4HfzEtKaDm9qS8JK1cyJ7fLKtL6JWlAh2CiMinb6j7SDl4zST4PGJDL0Z5lcS3 gtTlnmGlquwPnI2H2xtOJGhNwoNMyVDR+wsK5d/RVuAu9/eebbLmy5RDM5zDTIgQS4TH KmTcqcR8EZ0+Yp/neR1XEfGFc9j7CJ/k8uHBDTysBubABjfwO8UExK68Rnip5zzv0kGM oCHCATX+A2pda0iVSAJcqsbodGc9q8ugh0piAcf+6ycgemH1rs34SMOBiluoPPF6M0+F S05iTMTbXEg3WzfCJla9lPdaEkfkgu6QNaOnlqv4SXCdnXCl1OtLAb/AQ4W4hdl/4giL 3vyw== X-Gm-Message-State: AJcUukckaph+PqOVcCy5NhLimYC8Hp2bGo6t0T+hlSgdZIGEGM93lPjL B6PBEj1j0ZjllMkCvjtJ2LjiwMbmblKxomGsRW4= X-Google-Smtp-Source: ALg8bN73bIqgEii4jMEBFgPwFTxsY5zdRuQ5GYZ/0DAKRZDUbrIjP+39Phl+N/+P9Brgb0z+Od35t4+tu7Q6cWP+Llo= X-Received: by 2002:a6b:e919:: with SMTP id u25mr15731502iof.132.1545888223736; Wed, 26 Dec 2018 21:23:43 -0800 (PST) MIME-Version: 1.0 References: <87ftuk9klr.wl-jch@irif.fr> In-Reply-To: <87ftuk9klr.wl-jch@irif.fr> From: Donald Eastlake Date: Thu, 27 Dec 2018 00:23:32 -0500 Message-ID: To: Juliusz Chroboczek Cc: Babel at IETF , babel-chairs , draft-ietf-babel-hmac@ietf.org Content-Type: multipart/alternative; boundary="00000000000070392f057dfa262e" Archived-At: Subject: Re: [babel] Shepherd's review of draft-ietf-babel-hmac-02 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Dec 2018 05:23:49 -0000 --00000000000070392f057dfa262e Content-Type: text/plain; charset="UTF-8" Hi Juliusz, Deleting stuff where we don't disagree: On Wed, Dec 26, 2018 at 2:03 PM Juliusz Chroboczek wrote: > > ... > > > Section 5.2: > > The diagram is odd. I would recommend sliding the Index field and > > preceding vertical bar character to the left so it starts aligned > > with the Type. > > I've tried, but I didn't like the result. I'll leave it as it is, if > that's okay with you. I'm pretty sure the draft with the current figure is going to run into problems at AD review and if it survives that, I can pretty much guarantee the draft will run in problems with at least one AD when it hits the IESG. The current figure tries to be in the style used for protocol headers but that isn't the style normally used in the IETF for TLVs. The alternative figures I included in my comments are more in the traditional figure style for a Routing area TLV. See, for example, the numerous TLV and sub-TLV diagrams in https://tools.ietf.org/html/rfc7176 which are close to my second suggestion (except that I squeezed the lines a bit, dropping the alternative "+" signs so that four bytes would fit more easily on a line). Or https://tools.ietf.org/html/rfc8401 which has diagrams closer to my first example. If you really want to use a protocol header style figure for this TLV, I think you will end up needing to change it to something like the following: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length | PC - upper half | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PC - lower half | Index... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- > ... > > > While it is reasonable, for implementation convenience, that there is > > a maximum size for Index, perhaps for cryptographic strength, there > > should be a minimum length, maybe 12 bytes? > > I disagree. The only property that the index needs to satisfy is that it > is never reused for a different PC sequence for a given (key, sender) > pair. In particular, if a node never loses state (e.g. it has reliable > persistent storage), then it never needs to change indices -- and in that > case, a 0-octet index is suitable. The assumption that a node will never lose state and never count out the PC space seems quite brittle to me. > > ... Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 1424 Pro Shop Court, Davenport, FL 33896 USA d3e3e3@gmail.com > Thanks again, > > -- Juliusz --00000000000070392f057dfa262e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Juliusz,

Deleting stuff where we don't disag= ree:

On Wed, Dec 26, 2018 at 2:03 PM Juliusz Chroboczek <jch@irif.fr> wrote:
>
> ...
<= div>>
> > Section 5.2:
> > The diagram is odd. I would= recommend sliding the Index field and
> > preceding vertical bar = character to the left so it starts aligned
> > with the Type.
&= gt;
> I've tried, but I didn't like the result.=C2=A0 I'l= l leave it as it is, if
> that's okay with you.

I'm pr= etty sure the draft with the current figure is going to run into problems a= t AD review and if it survives that, I can pretty much guarantee the draft = will run in problems with at least one AD when it hits the IESG. The curren= t figure tries to be in the style used for protocol headers but that isn= 9;t the style normally used in the IETF for TLVs. The alternative figures I= included in my comments are more in the traditional figure style for a Rou= ting area TLV. See, for example, the numerous TLV and sub-TLV diagrams in <= a href=3D"https://tools.ietf.org/html/rfc7176">https://tools.ietf.org/html/= rfc7176 which are close to my second suggestion (except that I squeezed= the lines a bit, dropping the alternative "+" signs so that four= bytes would fit more easily on a line). Or https://tools.ietf.org/html/rfc8401 which has diagrams= closer to my first example.

If you really want to use a protocol he= ader style figure for this TLV, I think you will end up needing to change i= t to something like the following:
<= /font>
=C2=A0 =C2=A0 0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 1 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 3
=C2=A0 =C2=A0 0 1 2 3 4 5 6 7 8 9 0= 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
=C2=A0 =C2=A0+-+-+-+-+-+-+-+-= +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
=C2=A0 =C2=A0| =C2=A0 = =C2=A0 Type =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0Length =C2=A0 =C2=A0 |=C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0PC - upper half=C2=A0 =C2=A0 =C2=A0 =C2=A0|
= =C2=A0 =C2=A0+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-= +-+
=C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0PC - lower half=C2=A0 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0Index...
=C2=A0 =C2=A0+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-= +-+-+-+-+-

> ...
>
> > While it is reasonab= le, for implementation convenience, that there is
> > a maximum si= ze for Index, perhaps for cryptographic strength, there
> > should= be a minimum length, maybe 12 bytes?
>
> I disagree.=C2=A0 The= only property that the index needs to satisfy is that it
> is never = reused for a different PC sequence for a given (key, sender)
> pair.= =C2=A0 In particular, if a node never loses state (e.g. it has reliable
= > persistent storage), then it never needs to change indices -- and in t= hat
> case, a 0-octet index is suitable.

The assumption that a= node will never lose state and never count out the PC space seems quite br= ittle to me.=C2=A0

>
> ...

Thanks,
Donald<= br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D
=C2=A0Donald E. Eastlake 3rd =C2=A0 +1-508-333-227= 0 (cell)
=C2=A01424 Pro Shop Court, Davenport, FL 33896 USA
=C2=A0d3e3e3@gmail.com

> Thanks ag= ain,
>
> -- Juliusz
--00000000000070392f057dfa262e-- From nobody Wed Dec 26 22:22:26 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA9E9128CF3 for ; Wed, 26 Dec 2018 22:22:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VrWpXEt0XEn1 for ; Wed, 26 Dec 2018 22:22:20 -0800 (PST) Received: from mail-pg1-x52b.google.com (mail-pg1-x52b.google.com [IPv6:2607:f8b0:4864:20::52b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF137128BCC for ; Wed, 26 Dec 2018 22:22:20 -0800 (PST) Received: by mail-pg1-x52b.google.com with SMTP id z10so8414771pgp.7 for ; Wed, 26 Dec 2018 22:22:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=OqY0zrV7tT2GzegyJ+oyO1heBHTaGbz8OFmGEfTUW2I=; b=Oc3EEKgc8rw0ciLnjq/vmUZMcdQxCpvagh89qoz/kTnbXbQdeTjimjIDAVMtFrLd11 le8H+HGRIaqecbK0dl3WnhFSWt1x83mYvDPIgiVUOIZc4DVcJm96NSJVUyIv+MjZP07j re61KG4d6ivhRzjpsHdjODAyz3OF5QL93X0OruyCGAADuJVaxRB/3IQWOEnsPXjGe8Mq UJyHylh7fGPSue56mOk8t+TkurINRzVjBqd4pSc5EshFNj77fiLKEbxYBehjulLEHBQa 3tZ/6f6V5MqXIrA3P8RV92plOOeTg69ceFaK2LEF1R5kwvraGh6S0Hi6QKQPisiaMzgk B1dQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=OqY0zrV7tT2GzegyJ+oyO1heBHTaGbz8OFmGEfTUW2I=; b=EFu4D5XI1qkvYcOixakxjaKHhcaL8JWZH4TTepAQleZCK+LxmMmN74a65mdJz09+XL ricxK7f1b6ervBYkP2kNG13By6xlDOn37ozi9dArkgiCWkJlKS1LH/zq9X7nNcQZ5MMq tAKfnjaRM9fgUSXIHU+pmwBVGPs2/IHMg2/RtEAGwY7vv7t3i+C7lbU50ttoz/J4QDy8 JNgV78CNJ/OCLDPOgPcplwoJ9rXfUzIU2+hWZaGpfCFjZmT86/n7a3CzPK5z70gI4NWA XW5wXhXMM6dhtdjGtv3zilZBmOIjbqriRnRZOxeuvqojgxxi/ywYCifg6o8O7rkKPiSq rnvw== X-Gm-Message-State: AJcUukecb2Pz4+8mwpfb1daQgMSfB5kMB0VyV+kkJQV/5DZ9zg0gq1uM +9LPZaazjQS8MLO8SGu5ceE= X-Google-Smtp-Source: ALg8bN57nszERRbcLgXvFTCZewWa3jVJP8E7EyxRKB1fhP6XnzxKI41d2pMRyNnR3hOTgDBJbXNO+Q== X-Received: by 2002:a63:580a:: with SMTP id m10mr21175022pgb.332.1545891740105; Wed, 26 Dec 2018 22:22:20 -0800 (PST) Received: from [192.168.1.15] (c-71-198-190-15.hsd1.ca.comcast.net. [71.198.190.15]) by smtp.gmail.com with ESMTPSA id o84sm62277141pfi.172.2018.12.26.22.22.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Dec 2018 22:22:19 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Mahesh Jethanandani In-Reply-To: <87efa9legt.wl-jch@irif.fr> Date: Wed, 26 Dec 2018 22:22:17 -0800 Cc: "STARK, BARBARA H" , Babel at IETF Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114DF65C81@GAALPA1MSGUSRBF.ITServices.sbc.com> <87efa9legt.wl-jch@irif.fr> To: Juliusz Chroboczek X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [babel] info-model: message log X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Dec 2018 06:22:26 -0000 > On Dec 22, 2018, at 8:21 AM, Juliusz Chroboczek wrote: >=20 >> Here is my suggestion for having a message log: >=20 >> babel-message-log is: >> A reference or url link to a file that contains a timestamped log of = messages received and sent on babel-udp-port on all interfaces. File = format MUST be readable by Wireshark 1.8 or later and use the applicable = file format extension in the filename. Logging is enabled / disabled by = babel-message-log-enable. >=20 > Wireshark supports multiple formats, I'm not sure that it's a good = idea to > allow all of the formats supported by Wireshark. >=20 > I'm not intimately familiar with the capture packet formats. The = pcapng > file format appears to be the preferred format for wireshark, but the > internet-draft is expired since 2014; what's more, I'm not sure it's > supported by libpcap. Would agree that the capture format is a pcap file. I will not be = surprised if Wireshark does not understand Babel protocol, particularly = if no one has defined it in libpcap. Not too difficult to add though. >=20 > The traditional libpcap format is documented here: >=20 > https://wiki.wireshark.org/Development/LibpcapFileFormat >=20 > and it's likely to be supported by any tool in existence. Unless = somebody > has good technical reasons to avoid libpcap, I suggest we should = mandate > that format. >=20 > -- Juliusz >=20 > _______________________________________________ > babel mailing list > babel@ietf.org > https://www.ietf.org/mailman/listinfo/babel Mahesh Jethanandani mjethanandani@gmail.com From nobody Thu Dec 27 01:15:40 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D4D61295D8 for ; Thu, 27 Dec 2018 01:15:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DVKi0pgVMciZ for ; Thu, 27 Dec 2018 01:15:34 -0800 (PST) Received: from mail-oi1-x235.google.com (mail-oi1-x235.google.com [IPv6:2607:f8b0:4864:20::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9167F128D0C for ; Thu, 27 Dec 2018 01:15:34 -0800 (PST) Received: by mail-oi1-x235.google.com with SMTP id x23so14683942oix.3 for ; Thu, 27 Dec 2018 01:15:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hmKXNngbEJw2CoMLUGUz35ZVxLRSe/h7w/5m0PBD4cU=; b=W10dBMYQBvifdxv5ketfpttvSSNJ3trxCDiVMYXqSesK8RRZrRwStv9nB1/G/WCePg zRUjEi6onzzRFIyGCkSZXQ2EcMVyjma+elaB5SURR6bhfyZu16OOGFw91LMT2zNEp6RQ qBf2cNaO5+p3pQafDMF7wiugqa0TMW+wBxLs4lLLxG6ADOGYfmijVJD1ujVzKw/VUJpB ivm7yKWPigTXOX32J6AFnpgZVj4ZkJygJbGMc2EdlcDRr0Km+2till8knrNrfBmi350P UK6dqYZQFSnZZkWsnddwp6rBUWpuKRJBWOxsOsPY5F0ahzwL9rj5O7CFM9beLjB7KiA2 uxpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hmKXNngbEJw2CoMLUGUz35ZVxLRSe/h7w/5m0PBD4cU=; b=l7jdRIGj9lSzgxNfL0T0Xa68JWAGcZHimZ3vaXwPp49tOEtKVQ6XWvZxPCIq+cPptD QmwDLUxLD6EL0C8KjdQm/YBA/anbjw5dhLFN7WIwlVCQnb8m1b8AeqvYSDsB6VhXKBs6 JZaJdqbEFYHRPewKfFdFI+abKZzN77IUqsDwS3/cy5V4ICGcEVqSkVNMCTiS+Z8njLyc 294NvwT93lxahOeG79phHr7Cdqp5YeJQaufc66ZuXBBQJZ1Rv0AUN7+HYXneefmZDTVl +53yuy0TtCeQsAFbeFWqsOoNHb51tOzPOcL94Knxbv8MBxvms8lbvM2wYOPk9tuN0KfO avQA== X-Gm-Message-State: AA+aEWYts2Ld7OazkCaHUOCETs73z88y+nQ6p3f04mUVWw5foeNq8W08 lBSgPXNvO8FgzCytkr2jSA1mufzIsoQesqZapA33aw== X-Google-Smtp-Source: ALg8bN5AvgAYLPhkxCVQ1x55zgA3RB+MSbN18mMtF+QOaYZwlChua+/yCUX6dr2OamwCoF5ig1nmzkRUPd/bZhbHu+g= X-Received: by 2002:aca:4805:: with SMTP id v5mr13578299oia.292.1545902133541; Thu, 27 Dec 2018 01:15:33 -0800 (PST) MIME-Version: 1.0 References: <87ftuk9klr.wl-jch@irif.fr> In-Reply-To: From: Gabriel Kerneis Date: Thu, 27 Dec 2018 10:14:57 +0100 Message-ID: To: Donald Eastlake Cc: Juliusz Chroboczek , babel-chairs , Babel at IETF , draft-ietf-babel-hmac@ietf.org Content-Type: multipart/alternative; boundary="0000000000008759a6057dfd63e7" Archived-At: Subject: Re: [babel] Shepherd's review of draft-ietf-babel-hmac-02 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Dec 2018 09:15:40 -0000 --0000000000008759a6057dfd63e7 Content-Type: text/plain; charset="UTF-8" On Thu, Dec 27, 2018 at 6:23 AM Donald Eastlake wrote: > On Wed, Dec 26, 2018 at 2:03 PM Juliusz Chroboczek wrote: > > > > ... > > > > > Section 5.2: > > > The diagram is odd. I would recommend sliding the Index field and > > > preceding vertical bar character to the left so it starts aligned > > > with the Type. > > > > I've tried, but I didn't like the result. I'll leave it as it is, if > > that's okay with you. > > I'm pretty sure the draft with the current figure is going to run into > problems at AD review and if it survives that, I can pretty much guarantee > the draft will run in problems with at least one AD when it hits the IESG. > The current figure tries to be in the style used for protocol headers but > that isn't the style normally used in the IETF for TLVs. The alternative > figures I included in my comments are more in the traditional figure style > for a Routing area TLV. See, for example, the numerous TLV and sub-TLV > diagrams in https://tools.ietf.org/html/rfc7176 which are close to my > second suggestion (except that I squeezed the lines a bit, dropping the > alternative "+" signs so that four bytes would fit more easily on a line). > Or https://tools.ietf.org/html/rfc8401 which has diagrams closer to my > first example. > I implemented recently an (unreleased) parser for RFC 6126 bis, and I would definitely have appreciated diagrams looking like RFC 7176. I find them much easier to read, especially with the "(X bytes)" annotations. Gabriel --0000000000008759a6057dfd63e7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Dec 27, 2018 at 6:23 AM Donald Ea= stlake <d3e3e3@gmail.com> wro= te:
On Wed, Dec 26, 2018 at 2:03 PM Julius= z Chroboczek <jch@irif.= fr> wrote:
>
> ...
>
> > Section 5.2= :
> > The diagram is odd. I would recommend sliding the Index fiel= d and
> > preceding vertical bar character to the left so it start= s aligned
> > with the Type.
>
> I've tried, but I= didn't like the result.=C2=A0 I'll leave it as it is, if
> t= hat's okay with you.

I'm pretty sure the draft with the curr= ent figure is going to run into problems at AD review and if it survives th= at, I can pretty much guarantee the draft will run in problems with at leas= t one AD when it hits the IESG. The current figure tries to be in the style= used for protocol headers but that isn't the style normally used in th= e IETF for TLVs. The alternative figures I included in my comments are more= in the traditional figure style for a Routing area TLV. See, for example, = the numerous TLV and sub-TLV diagrams in https://tools.ietf.org/html/rfc7176 whi= ch are close to my second suggestion (except that I squeezed the lines a bi= t, dropping the alternative "+" signs so that four bytes would fi= t more easily on a line). Or https://tools.ietf.org/html/rfc8401 which has diagr= ams closer to my first example.

=
I implemented recently an (unreleased) parser for RFC 6126 bis, = and I would definitely have appreciated diagrams looking like RFC 7176. I f= ind them much easier to read, especially with the "(X bytes)" ann= otations.

Gabriel
--0000000000008759a6057dfd63e7-- From nobody Thu Dec 27 20:05:52 2018 Return-Path: X-Original-To: babel@ietf.org Delivered-To: babel@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E4B1312870E; Thu, 27 Dec 2018 20:05:50 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: babel-chairs@ietf.org, d3e3e3@gmail.com, martin.vigoureux@nokia.com, babel@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.89.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <154596995089.11942.14370283553755519190.idtracker@ietfa.amsl.com> Date: Thu, 27 Dec 2018 20:05:50 -0800 Archived-At: Subject: [babel] babel - New Meeting Session Request for IETF 104 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Dec 2018 04:05:51 -0000 A new meeting session request has just been submitted by Donald E. Eastlake 3rd, a Chair of the babel working group. --------------------------------------------------------- Working Group Name: Babel routing protocol Area Name: Routing Area Session Requester: Donald Eastlake Number of Sessions: 1 Length of Session(s): 1.5 Hours Number of Attendees: 35 Conflicts to Avoid: First Priority: rtgwg idr bess sfc Second Priority: dnsop saag lsr secdispatch Third Priority: mptcp rtgarea cfrg homenet People who must be present: Donald E. Eastlake 3rd Russ White Martin Vigoureux Resources Requested: Special Requests: Meeting toward the end of the day Thursday or in the last slot Thursday has worked well for BABEL. --------------------------------------------------------- From nobody Thu Dec 27 20:34:53 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41A36130FBF for ; Thu, 27 Dec 2018 20:34:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IPCgkcdeGhYR for ; Thu, 27 Dec 2018 20:34:51 -0800 (PST) Received: from mail-it1-x131.google.com (mail-it1-x131.google.com [IPv6:2607:f8b0:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4E4F130FB7 for ; Thu, 27 Dec 2018 20:34:50 -0800 (PST) Received: by mail-it1-x131.google.com with SMTP id i145so27009802ita.4 for ; Thu, 27 Dec 2018 20:34:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=adhV4OZv76rxmAKXRHOHerlnWXBUyqXtzArfB9VPMdQ=; b=gduJFRG7Te0BRSwZTZcfY+XxbuALxlpnSKISBxly8UfDBb8xyq09w7OIiwdI6AOXkB ZWR2WmVsnNRG10GlVvvMyzgYYyYlIhkl4x+gBdkQXzDh4GzwHLO2IjRtWhWAT772b8Ce 0PlruRXnbgFtETGhgm/375Zna8fx59edfV/E7BMp9FAiuCeJDEOTo1KFW1navVUBjDAy 5mdIds1NvD7znVG10OK6wT/cssX7s6eeGuoEf9NpPXgPWsaa+tX3kUImiqm4Axbg4ZAe 6KmEy5/1yy6fEZqCaSMmmp66faLloxIjSn562ejfQn1ZxxpbFdfeNjsQvJ96O15Uqlc6 ufAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=adhV4OZv76rxmAKXRHOHerlnWXBUyqXtzArfB9VPMdQ=; b=CQbyyMYNXlJVhOi/c7Wy98pTP6YQjgzQXzo+DZCyW9FLZyz+IfeaGWVvE7FQ2aYehD aWo2UYOsgcBz1E4WXhZG6i3PNcbwdMER7RWh7235XCcQMIqCrR67pDkVEahrB+4TyjZV AcHR6BzuCHvhGOrmlXRhsi2IQdc77SL2qjJPnTUnWiTW7ibxnmXsxiW/Pti/Eommcuyi 6weLq8q04Ms9QM2DueaaOMBQccMx/c3eXVjrU5efeEnkTTCtrJHIF5m1eMOvk/ykQ9n3 Mf4aSg9+OlE0gISfITEOYVJOynVkyrxOAWWW+D45fTaOmYKdkdutTQH7Ni04c1Y1Oedr mReQ== X-Gm-Message-State: AA+aEWbja3Rbqqqy4PovHF6ag3tDmccWZ+Mjsnz5WVYcJNDHF0w1kKSJ mY6to3rgkMfkVXAyb+ySuO99Y3Qe7C2gz2iBANWw14oP X-Google-Smtp-Source: ALg8bN7bQu6CIgXZ6XpVkgNB/TTEJkPNMzysqpXhlLqLTkC9OyQ9UBpu+yY+GdfCcdF+dzSwq0ce8U/vhX6ERCK2UJc= X-Received: by 2002:a24:36cf:: with SMTP id l198mr18059860itl.102.1545971689785; Thu, 27 Dec 2018 20:34:49 -0800 (PST) MIME-Version: 1.0 From: Donald Eastlake Date: Thu, 27 Dec 2018 23:34:38 -0500 Message-ID: To: Babel at IETF Content-Type: multipart/alternative; boundary="0000000000006711a4057e0d9555" Archived-At: Subject: [babel] Document Shepherd review of draft-ietf-babel-source-specific-04 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Dec 2018 04:34:52 -0000 --0000000000006711a4057e0d9555 Content-Type: text/plain; charset="UTF-8" I read draft-ietf-babel-source-specific-04. It seems to be in good shape but and I have the following thought: I believe babel-source-specific does not have routing loops even with a mixture of BABEL routers supporting and not supporting source-specific if routing messages are well formed. However, if a routing message is interpreted differently by different routers, then it seems to me that you might get loops. In Section 7, 2nd paragraph, the flexibility that "a node receiving more than one Source Prefix sub-TLV in a single TLV SHOULD ignore this TLV. It MAY ignore the whole packet." seems like it might cause problems. Assuming a malformed message with two Source Prefix sub-TLVs where one router accepts it and uses the first while the other accepts it and uses the second, or the other possibilities where they end up with persistent different routing states. Perhaps it would be better to say "a node receiving more than one Source Prefix sub-TLV in a single TLV MUST ignore this TLV." (or only use the first or last sub-TLV or any other precisely deterministic rule). Similarly, in Section 7.2, it says "A wildcard retraction (Update with AE equals to 0) MUST NOT carry a Source Prefix sub-TLV." So what happens if it does? I would feel more confident if it said something deterministic so either (1) it MUST NOT carry a Source Prefix sub-TLV and MUST be ignored if it does or (2) it MUST Not carry a Source Prefix sub-TLV and if it does, the Source Prefix sub-TLV is ignored. Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 1424 Pro Shop Court, Davenport, FL 33896 USA d3e3e3@gmail.com --0000000000006711a4057e0d9555 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I read draft-ietf-babel-source-speci= fic-04. It seems to be in good shape but and I have the following thought:<= /div>

I believe babel-source-specific does not have rout= ing loops even with a mixture of BABEL routers supporting and not supportin= g source-specific if routing messages are well formed. However, if a routin= g message is interpreted differently by different routers, then it seems to= me that you might get loops. In Section 7, 2nd paragraph, the flexibility = that=C2=A0
=C2=A0 =C2=A0 =C2=A0 "a node
=C2=A0 =C2= =A0receiving more than one Source Prefix sub-TLV in a single TLV SHOULD
=C2=A0 =C2=A0ignore this TLV.=C2=A0 It MAY ignore the whole packet.&= quot;
seems like it might cause problems. Assuming a malformed me= ssage with two Source Prefix sub-TLVs where one router accepts it and uses = the first while the other accepts it and uses the second, or the other poss= ibilities where they end up with persistent different routing states. Perha= ps it would be better to say "a node receiving more than one Source Pr= efix sub-TLV in a single TLV MUST ignore this TLV." (or only use the f= irst or last sub-TLV or any other precisely deterministic rule). Similarly,= in Section 7.2, it says
=C2=A0 =C2=A0 =C2=A0 "A
= =C2=A0 =C2=A0wildcard retraction (Update with AE equals to 0) MUST NOT carr= y a
=C2=A0 =C2=A0Source Prefix sub-TLV."
So what h= appens if it does? I would feel more confident if it said something determi= nistic so either (1) it MUST NOT carry a Source Prefix sub-TLV and MUST be = ignored if it does or (2) it MUST Not carry a Source Prefix sub-TLV and if = it does, the Source Prefix sub-TLV is ignored.

Thanks,
Donald
=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D
=C2=A0Donald E. Eastlake 3rd =C2=A0 +1-508-333-2270 (cell)
=C2= =A01424 Pro Shop Court, Davenport, FL 33896 USA
=C2=A0d3e3e3@gmail.com
<= /div> --0000000000006711a4057e0d9555-- From nobody Sat Dec 29 16:08:12 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79246130DC0 for ; Sat, 29 Dec 2018 16:08:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dgw8VcMNIwlg for ; Sat, 29 Dec 2018 16:08:08 -0800 (PST) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3045C1294D0 for ; Sat, 29 Dec 2018 16:08:07 -0800 (PST) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id wBU07xu0032683; Sun, 30 Dec 2018 01:07:59 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 0BF3D20508; Sun, 30 Dec 2018 01:08:05 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id o0sGc4B7kzvN; Sun, 30 Dec 2018 01:08:03 +0100 (CET) Received: from pirx.irif.fr (unknown [80.50.139.114]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 3709520505; Sun, 30 Dec 2018 01:08:02 +0100 (CET) Date: Sun, 30 Dec 2018 01:08:01 +0100 Message-ID: <87muonev1a.wl-jch@irif.fr> From: Juliusz Chroboczek To: Donald Eastlake Cc: Babel at IETF In-Reply-To: References: User-Agent: Wanderlust/2.15.9 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sun, 30 Dec 2018 01:07:59 +0100 (CET) X-Miltered: at korolev with ID 5C280C5F.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5C280C5F.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5C280C5F.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Archived-At: Subject: Re: [babel] Document Shepherd review of draft-ietf-babel-source-specific-04 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Dec 2018 00:08:11 -0000 Thanks a lot for the review, Donald. We're slightly incoherent here: - Section 7 says that multiple sub-TLVs in a single Update MUST NOT be sent and the whole TLV SHOULD be ignored; - Section 7 also says that a sub-TLV in a retraction MUST NOT be sent, while Section 5 says that such a sub-TLV MUST be ignored on reception. (You appear to have missed the bit in Section 5, which I cannot blame you for -- it needs repeating in Section 7). The reason for the inconsistence is that an implementation must check for the presence of the sub-TLV in any case, so the requirement to discard retractions with the sub-TLV puts no extra onus on implementations. On the other hand, checking for the case of multiple occurrences of the sub-TLV puts a small cost on implementations, but one that's probably negligible. I'm definitely going to update Section 7 to repeat the requirement in Section 5. I think you're right, that the SHOULD about multiple sub-TLVs should be a MUST, but I want to sleep over it and check the implementation. Toke, do you have an opinion? -- Juliusz From nobody Mon Dec 31 04:35:50 2018 Return-Path: X-Original-To: babel@ietfa.amsl.com Delivered-To: babel@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF4BC127B4C for ; Mon, 31 Dec 2018 04:35:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=toke.dk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VMpN16gElJuX for ; Mon, 31 Dec 2018 04:35:45 -0800 (PST) Received: from mail.toke.dk (mail.toke.dk [52.28.52.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1553D1277BB for ; Mon, 31 Dec 2018 04:35:44 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1546259739; bh=hIEB2+QJc/q2Y9RAYEzpS1fMMjLBj/wZIriX66Q2sW0=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=DmM/qFxHK4rpPQBbv1IsM2U6vA4dl3LJxmlzfGqmSIq7znfoROe5FNrcEiAQ9Uu8A pTkKEpA6InA5i455I7qc+kBmY8elZ1KNW2I+tuDzbRQy1VO4/WNVgc8ViRZkKdUvjq dzNQDzQufNrfghhP9Cqg+wtO6Sh73zB0K758qhr81AuQAJcbN1D1ZoPuJmXlLEKJ3b vyJOxC4usNzm8umgmDjGpY0jwa2Nt3F7SxHyly9eziU2jJhMRdr9UCA4dKHfXnrRBU 52B2buxE2lcOIzyI0adVt9YPnSN+ssVFBwEIftbZi76kdF3WNbK9D4PsDxqpqj1hs/ Rxj4f3FgMRdXA== To: Juliusz Chroboczek , Donald Eastlake Cc: Babel at IETF In-Reply-To: <87muonev1a.wl-jch@irif.fr> References: <87muonev1a.wl-jch@irif.fr> Date: Mon, 31 Dec 2018 13:35:34 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87bm51g9gp.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [babel] Document Shepherd review of draft-ietf-babel-source-specific-04 X-BeenThere: babel@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A list for discussion of the Babel Routing Protocol." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Dec 2018 12:35:48 -0000 Juliusz Chroboczek writes: > I think you're right, that the SHOULD about multiple sub-TLVs should be > a MUST, but I want to sleep over it and check the implementation. Toke, > do you have an opinion? Bird already ignores the whole TLV if it has more than one SS sub-tlv in it. No objection to making this mandatory :) -Toke