Subject: RE: [ipfix] RE: IPFIX requirements - security

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Fri, 20 Feb 2004 17:32:22 +0100

> > Juergen,
> >
> > The agreement regarding security was:
> > http://ipfix.doit.wisc.edu/archive/1892.html
> > My personal view is at:
> > http://ipfix.doit.wisc.edu/archive/1898.html
> >
> > I think the IPFIX requirement draft is fine like this
> > IF AND ONLY IF the protocol draft respect the agreement above.
> > So a MUST for implementation
> > So a MAY or SHOULD for mandatory to use.
> 
> Let's phrase it: use is RECOMMENDED or OPTIONAL, but not MANDATORY
> 
> This is the interpretation of the current version
> of the requirements document that was shared by the WG
> so far and with that IMHO we should go on.
> 
> But Stewart's point was that the MUST for implementation
> puts is an inappropriate burden on the implementation.
> 
And I will say again, that I doubt that you will get away with
anything else than a "MUST implement". But you can try it again and
see if that will result in the document to be rejected and delayed 
once more.

Bert
> Thanks,
> 
>     Juergen
> 
> > Regards, Benoit.
> >
> >> Dear all,
> >>
> >> There has been no further reply on this issue on the IPFIX
> >> mailing list.  My interpretation of this silence is that we
> >> do not call the document back from IESG review but support
> >> its further progress towards an informational RFC.
> >>
> >> Does anybody disagree with this interpretation??
> >>
> >> Thanks,
> >>
> >>    Juergen
> >>
> >>
> >> --On 03.02.2004 16:03 Uhr +0100 Wijnen, Bert (Bert) wrote:
> >>
> >>> You can call it back, but I doubt you can get away with what
> >>> Stewart wants.
> >>>
> >>> Thanks,
> >>> Bert
> >>>
> >>>> -----Original Message-----
> >>>> From: Juergen Quittek [mailto:[email-masked]]
> >>>> Sent: dinsdag 3 februari 2004 15:52
> >>>> To: [email-masked]
> >>>> Cc: [email-masked]; allison mankin; [email-masked]
> >>>> Subject: Re: IPFIX requirements - security
> >>>>
> >>>>
> >>>> Dear all,
> >>>>
> >>>> What shall we do with Stewart's issue?
> >>>>
> >>>> The requirements draft is under IESG review.
> >>>> Shall we call it back from there?
> >>>>
> >>>>     Juergen
> >>>>
> >>>>
> >>>> --On 03.02.2004 10:39 Uhr +0000 Stewart Bryant wrote:
> >>>>
> >>>> >
> >>>> >
> >>>> > Juergen Quittek wrote:
> >>>> >
> >>>> >> Stewart,
> >>>> >>
> >>>> >> We changed the requirement for confidentiality from SHOULD
> >>>> to MUST in
> >>>> >> October.
> >>>> >> It was based on a comment from Allison:
> >>>> >>
> >>>> >>   "Requirements on the ipfix implementation - the document
> >>>> is long and
> >>>> >>    I wonder if the working group really meant the protocol's
> >>>> >> confidentiality
> >>>> >>    and anonymization features to be so optional -  SHOULD
> >>>> confidentiality,
> >>>> >>    MAY anonymization. Just for implementation."
> >>>> >>
> >>>> >> So far there was an agreement on this change on the
> >>>> mailing list as well as
> >>>> >> at the last IPFIX session, where this particular issue was
> >>>> presented.
> >>>> >> This does not mean, that we may not discuss the issue
> >>>> anymore, but so far,
> >>>> >> we had an agreement.
> >>>> >>
> >>>> >> I see the higher implementation effort, but I also see
> >>>> that most new
> >>>> >> devices
> >>>> >> today implement IPsec anyway.  So, I would be fine 
> with both ways.
> >>>> >>
> >>>> >
> >>>> > On the other hand we also talk about the performance issues
> >>>> of IPFIX,
> >>>> > and IPsec will mean either a lot of CPU cycles or 
> hardware support.
> >>>> > Also to be of use in a reasonable timeframe, IPFIX has 
> to work on
> >>>> > existing platforms.
> >>>> >
> >>>> > Now I do not have any problem with requiring the 
> system to provide
> >>>> > confidentially etc, it's just that the way that the requirement
> >>>> > is written, the protocol MUST support it, which constrains the
> >>>> > implementation choices.
> >>>> >
> >>>> > - Stewart
> >>>> >
> >>>> >> Are there people on the mailing list who either agree 
> or disagree?
> >>>> >> Please speak up.
> >>>> >>
> >>>> >> Thanks,
> >>>> >>
> >>>> >>    Juergen
> >>>> >
> >>>>
> >>>>
> >>>>
> >>>>
> >>
> >>
> >>
> >>
> >>
> >> --
> >> Help        mailto:[email-masked] and say "help" in
> >> message body
> >> Unsubscribe mailto:[email-masked] and say
> >> "unsubscribe ipfix" in message body
> >> Archive     http://ipfix.doit.wisc.edu/archive/
> >
> >
> 
> 
> 
> 
> 
> 
> 
> --
> Help        mailto:[email-masked] and say "help" 
> in message body
> Unsubscribe mailto:[email-masked] and say
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/
> 

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Stewart Bryant <[email-masked]>
Date: Fri, 20 Feb 2004 17:41:21 +0000

> see if that will result in the document to be rejected and delayed 

I will be OK with a must implement, if, but only if, that does not
imply a must use.

Stewart