Subject: Re: [ipfix] IPFIX requirements - final changes

From: Benoit Claise <[email-masked]>
Date: Mon, 02 Jun 2003 12:28:19 +0200

Juergen,

> Tal, Reinaldo, and Benoit,
>
> Do we all have the following in mind?
>
>   Anonymization and confidentiality MUST be covered by the
>   protocol specification.  But the protocol specifiction
>   specification defines it as a MAY feature (anonymization)
>   or SHOULD feature (confidentiality) for IPFIX protocol
>   implementations. 

Yes, absolutely.

Regards, Benoit.

>
>
> I guess this is what the IESG reviewers were referring to.
>
> What is probably missing in the requirements document is a
> statement like the following:
>
>   Many requirements in this document are not explicitly
>   stated as IPFIX protocol requirements, but as requirements
>   for the metering process, the exporting process, or for
>   other traffic measurement components. However, every
>   requirement that needs support from the IPFIX protocol
>   MUST be covered by the IPFIX protocol specification
>   independent of the significance of the requirement,
>   which can be MANDATOYRY, RECOMMENDED, or OPTIONAL.
>   Note that the protocol specification itself also assigns
>   significance attributes to its features, such that a
>   protocol implementation does not necessarily need to
>   implement all features.
>
> Any comment on this?
>
>    Juergen
>
>
> -- Tal Givoly wrote on 26 May 2003 09:42 -0700:
>
>> Juergen,
>>
>> I agree with Benoit - it doesn't make sense to make confidentiality and
>> anonymization mandatory. In many deployments, there could be physical 
>> and
>> other security measures that addresses these issues.
>>
>> Tal
>>
>> -----Original Message-----
>> From: majordomo listserver [mailto:[email-masked]]On Behalf
>> Of Benoit Claise
>> Sent: Monday, May 26, 2003 8:02 AM
>> To: Juergen Quittek
>> Cc: [email-masked]
>> Subject: Re: [ipfix] IPFIX requirements - final changes
>>
>>
>> Juergen,
>>
>>> ========================================================================
>>> 12. Confidentiality from SHOULD to MUST
>>> ========================================================================
>>> Problem Description:
>>> ------------------------------------------------------------------------
>>> Requirements on the ipfix implementation - the document is long and I
>>> wonder if
>>> the working group really meant the protocol's confidentiality and
>>> anonymization
>>> features to be so optional -  SHOULD confidentiality, MAY 
>>> anonymization.
>>> Just for implementation.
>>> ========================================================================
>>> Suggested solution:
>>> ------------------------------------------------------------------------
>>>   change confidentiality requirement in section 6.3.3
>>>   from SHOULD to MUST
>>> ========================================================================
>>> Status: solution to be agreed on
>>> ========================================================================
>>
>>
>> I'm just wondering if a MUST is not a little bit extreme.
>> The draft would become:
>>    "Confidentiality of flow specific data transferred from an exporting
>>    process to a collecting process MUST be ensured."
>> We all agree that over the Internet confidentiality is compulsory but
>> this sentence would mean that even in a private LAN or environment, we
>> must have confidentiality to be IPFIX compliant. And we know that, with
>> the software based encryption, the throughput would be lowered. Ok, then
>> we should have an crypto engine in hardware on the exporter to export
>> the numerous flow export packets but there is a price to it.
>> My point is that, as Confidentiality is not needed in all cases, why
>> make it a MUST?
>>
>>>
>>>
>>>
>>> ========================================================================
>>> 13. Anonymization from MAY to MUST
>>> ========================================================================
>>> Problem Description:
>>> ------------------------------------------------------------------------
>>> Requirements on the ipfix implementation - the document is long and I
>>> wonder if
>>> the working group really meant the protocol's confidentiality and
>>> anonymization
>>> features to be so optional -  SHOULD confidentiality, MAY 
>>> anonymization.
>>> Just for implementation.
>>> ========================================================================
>>> Suggested solution:
>>> ------------------------------------------------------------------------
>>>   change anonymization requirement in section 6.7 from MAY to MUST
>>> ========================================================================
>>> Status: solution to be agreed on
>>> ========================================================================
>>
>>
>> Again, I have the same type of comments. Anonymization is not required
>> in all cases. So why make it a MUST?
>>
>> Regards, Benoit.
>>
>>
>>
>> -- 
>> Help        mailto:[email-masked] and say "help" in message
>> body
>> Unsubscribe mailto:[email-masked] and say
>> "unsubscribe ipfix" in message body
>> Archive     http://ipfix.doit.wisc.edu/archive/
>>
>

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Benoit Claise <[email-masked]>
Date: Mon, 02 Jun 2003 12:28:34 +0200

Sebastian,

> But i do *not* agree at all that in general anonymization and
> confidentiality is not needed in a LAN. Anonymization can be required
> in a LAN and even in a LAN confidentiality may be needed because i
> don't want everybody who has access to my LAN to have access to my
> IPFIX data. 

I think that I caused this reaction by my first email on this topic.
Obviously, you are right that it might be needed in a LAN environment!
My point was not to deduce generic situations where we need/don't need 
anonymization/confidentiality.
I wanted to stress that it must be left open to the implementors.
And I think we all agree on this point.

Regards, Benoit.

> Cheers,
> Sebastian
> Juergen Quittek wrote:
>>> anonymization mandatory. In many deployments, there could be 
>>> physical and