Subject: [lmap] Kathleen Moriarty's No Objection on draft-ietf-lmap-framework-12: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 08 Apr 2015 19:17:52 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-lmap-framework-12: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-lmap-framework/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for your very careful and detailed attention to security and
privacy, with options suggested to protect privacy in practice through
group ids instead of ones that identify an individual.

I just have one question. The security considerations section has a lower
case 'must' for providing session encryption, but then the privacy
section warns that monitoring can be possible when sessions are not
encrypted.  When I saw the privacy considerations, I went back to the
security section to make sure active attacks against session traffic that
was not encrypted was addressed as I didn't see this same 'must' and by
that time needed to go back to make sure something as in place.  I'm
wondering why these weren't just addressed together since more security
things could happen too if sessions were not encrypted (in other words,
there could be less text, unless I am missing something and we need more
on the security side).  Thanks!

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Sun, 12 Apr 2015 17:49:35 -0400

Hi Kathleen,

> -----Original Message-----
> From: lmap [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
...
> I just have one question. The security considerations section has a
> lower case 'must' for providing session encryption, but then the privacy
> encrypted.  

lc must is as demanding as we get in this memo, there are no 2119 terms as agreed.

You may be referring to this sentence at the end of the privacy section, 8.4.4
and the figure in that section:

	If the Measurement Traffic is unencrypted, as found in many systems today, 
	then both timing and limited results are open to on-path observers.

The measurement traffic is distinctly different from the 
LMAP Control and Reporting protocols. We have ability/scope to
specify requirements on the LMAP Control and Reporting protocols,
and have required encryption.

The measurement traffic itself is out of scope for LMAP.
It may be unencrypted user traffic which we observe passively,
or it may be an un-encrypted (active) stream dedicated to measurement
(which is in the clear to avoid encryption processing with its
impact on performance - the objective is to assess the network).
But even this active measurement traffic would likely be encrypted when
e2e encryption becomes the norm.

> When I saw the privacy considerations, I went back to the
> security section to make sure active attacks against session traffic
> that was not encrypted was addressed as I didn't see this same 'must'
> and by that time needed to go back to make sure something as in place.
> I'm wondering why these weren't just addressed together since more
> security things could happen too if sessions were not encrypted (in
> other words, there could be less text, unless I am missing something and
> we need more on the security side).  Thanks!
> 
Attacks on measurement traffic and their supporting protocols are
covered in the relevant WG literature (e.g., IPPM and IPFIX).

hope this helps,
Al