Subject: Re: [ipfix] RE: IPFIX requirements - security

From: Juergen Quittek <[email-masked]>
Date: Fri, 20 Feb 2004 03:38:57 +0100

Benoit,

--On 19.02.2004 17:37 Uhr +0100 Benoit Claise wrote:

> Juergen,
>
> The agreement regarding security was:
> http://ipfix.doit.wisc.edu/archive/1892.html
> My personal view is at:
> http://ipfix.doit.wisc.edu/archive/1898.html
>
> I think the IPFIX requirement draft is fine like this
> IF AND ONLY IF the protocol draft respect the agreement above.
> So a MUST for implementation
> So a MAY or SHOULD for mandatory to use.

Let's phrase it: use is RECOMMENDED or OPTIONAL, but not MANDATORY

This is the interpretation of the current version
of the requirements document that was shared by the WG
so far and with that IMHO we should go on.

But Stewart's point was that the MUST for implementation
puts is an inappropriate burden on the implementation.

Thanks,

    Juergen

> Regards, Benoit.
>
>> Dear all,
>>
>> There has been no further reply on this issue on the IPFIX
>> mailing list.  My interpretation of this silence is that we
>> do not call the document back from IESG review but support
>> its further progress towards an informational RFC.
>>
>> Does anybody disagree with this interpretation??
>>
>> Thanks,
>>
>>    Juergen
>>
>>
>> --On 03.02.2004 16:03 Uhr +0100 Wijnen, Bert (Bert) wrote:
>>
>>> You can call it back, but I doubt you can get away with what
>>> Stewart wants.
>>>
>>> Thanks,
>>> Bert
>>>
>>>> -----Original Message-----
>>>> From: Juergen Quittek [mailto:[email-masked]]
>>>> Sent: dinsdag 3 februari 2004 15:52
>>>> To: [email-masked]
>>>> Cc: [email-masked]; allison mankin; [email-masked]
>>>> Subject: Re: IPFIX requirements - security
>>>>
>>>>
>>>> Dear all,
>>>>
>>>> What shall we do with Stewart's issue?
>>>>
>>>> The requirements draft is under IESG review.
>>>> Shall we call it back from there?
>>>>
>>>>     Juergen
>>>>
>>>>
>>>> --On 03.02.2004 10:39 Uhr +0000 Stewart Bryant wrote:
>>>>
>>>> >
>>>> >
>>>> > Juergen Quittek wrote:
>>>> >
>>>> >> Stewart,
>>>> >>
>>>> >> We changed the requirement for confidentiality from SHOULD
>>>> to MUST in
>>>> >> October.
>>>> >> It was based on a comment from Allison:
>>>> >>
>>>> >>   "Requirements on the ipfix implementation - the document
>>>> is long and
>>>> >>    I wonder if the working group really meant the protocol's
>>>> >> confidentiality
>>>> >>    and anonymization features to be so optional -  SHOULD
>>>> confidentiality,
>>>> >>    MAY anonymization. Just for implementation."
>>>> >>
>>>> >> So far there was an agreement on this change on the
>>>> mailing list as well as
>>>> >> at the last IPFIX session, where this particular issue was
>>>> presented.
>>>> >> This does not mean, that we may not discuss the issue
>>>> anymore, but so far,
>>>> >> we had an agreement.
>>>> >>
>>>> >> I see the higher implementation effort, but I also see
>>>> that most new
>>>> >> devices
>>>> >> today implement IPsec anyway.  So, I would be fine with both ways.
>>>> >>
>>>> >
>>>> > On the other hand we also talk about the performance issues
>>>> of IPFIX,
>>>> > and IPsec will mean either a lot of CPU cycles or hardware support.
>>>> > Also to be of use in a reasonable timeframe, IPFIX has to work on
>>>> > existing platforms.
>>>> >
>>>> > Now I do not have any problem with requiring the system to provide
>>>> > confidentially etc, it's just that the way that the requirement
>>>> > is written, the protocol MUST support it, which constrains the
>>>> > implementation choices.
>>>> >
>>>> > - Stewart
>>>> >
>>>> >> Are there people on the mailing list who either agree or disagree?
>>>> >> Please speak up.
>>>> >>
>>>> >> Thanks,
>>>> >>
>>>> >>    Juergen
>>>> >
>>>>
>>>>
>>>>
>>>>
>>
>>
>>
>>
>>
>> --
>> Help        mailto:[email-masked] and say "help" in
>> message body
>> Unsubscribe mailto:[email-masked] and say
>> "unsubscribe ipfix" in message body
>> Archive     http://ipfix.doit.wisc.edu/archive/
>
>

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Fri, 20 Feb 2004 18:51:27 +0100

> > And I will say again, that I doubt that you will get away with
> > anything else than a "MUST implement". But you can try it again and
> > see if that will result in the document to be rejected and delayed 
> > once more.
> > 
> 
> I will be OK with a must implement, if, but only if, that does not
> imply a must use.
> 
That is OK. ANd Juegen claims that that is what the document says,
right. I believe the doc DOES say that the transport must be secure
(protected), but that can be done on various ways, once way is to
encrypt of course (and if the must implement encryption technology
is specified, then indeed very user does have that option).

Bert
> Stewart