Subject: [ipfix] RE: IPFIX requirements - security

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Tue, 3 Feb 2004 16:03:36 +0100

You can call it back, but I doubt you can get away with what
Stewart wants.

Thanks,
Bert 

> -----Original Message-----
> From: Juergen Quittek [mailto:[email-masked]]
> Sent: dinsdag 3 februari 2004 15:52
> To: [email-masked]
> Cc: [email-masked]; allison mankin; [email-masked]
> Subject: Re: IPFIX requirements - security
> 
> 
> Dear all,
> 
> What shall we do with Stewart's issue?
> 
> The requirements draft is under IESG review.
> Shall we call it back from there?
> 
>     Juergen
> 
> 
> --On 03.02.2004 10:39 Uhr +0000 Stewart Bryant wrote:
> 
> >
> >
> > Juergen Quittek wrote:
> >
> >> Stewart,
> >>
> >> We changed the requirement for confidentiality from SHOULD 
> to MUST in
> >> October.
> >> It was based on a comment from Allison:
> >>
> >>   "Requirements on the ipfix implementation - the document 
> is long and
> >>    I wonder if the working group really meant the protocol's
> >> confidentiality
> >>    and anonymization features to be so optional -  SHOULD 
> confidentiality,
> >>    MAY anonymization. Just for implementation."
> >>
> >> So far there was an agreement on this change on the 
> mailing list as well as
> >> at the last IPFIX session, where this particular issue was 
> presented.
> >> This does not mean, that we may not discuss the issue 
> anymore, but so far,
> >> we had an agreement.
> >>
> >> I see the higher implementation effort, but I also see 
> that most new
> >> devices
> >> today implement IPsec anyway.  So, I would be fine with both ways.
> >>
> >
> > On the other hand we also talk about the performance issues 
> of IPFIX,
> > and IPsec will mean either a lot of CPU cycles or hardware support.
> > Also to be of use in a reasonable timeframe, IPFIX has to work on
> > existing platforms.
> >
> > Now I do not have any problem with requiring the system to provide
> > confidentially etc, it's just that the way that the requirement
> > is written, the protocol MUST support it, which constrains the
> > implementation choices.
> >
> > - Stewart
> >
> >> Are there people on the mailing list who either agree or disagree?
> >> Please speak up.
> >>
> >> Thanks,
> >>
> >>    Juergen
> >
> 
> 
> 
> 

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: Juergen Quittek <[email-masked]>
Date: Tue, 17 Feb 2004 11:35:16 +0100

Dear all,

There has been no further reply on this issue on the IPFIX
mailing list.  My interpretation of this silence is that we
do not call the document back from IESG review but support
its further progress towards an informational RFC.

Does anybody disagree with this interpretation??

Thanks,

    Juergen

---

From: Benoit Claise <[email-masked]>
Date: Thu, 19 Feb 2004 17:37:58 +0100

Juergen,

The agreement regarding security was:
http://ipfix.doit.wisc.edu/archive/1892.html
My personal view is at:
http://ipfix.doit.wisc.edu/archive/1898.html

I think the IPFIX requirement draft is fine like this IF AND ONLY IF the 
protocol draft respect the agreement above.
So a MUST for implementation
So a MAY or SHOULD for mandatory to use.

Regards, Benoit.