Subject: [secdir] R: secdir review of draft-ietf-ipfix-flow-selection-tech

From: "Salvatore D'Antonio" <[email-masked]>
Date: Sat, 23 Feb 2013 15:25:59 +0100

Dear all,

A new version of the Internet Draft has been submitted that addresses
comments from Benoit and Dan Harkins.

Kind regards,

Salvatore

-----Messaggio originale-----
Da: Nevil Brownlee [mailto:[email-masked]] 
Inviato: giovedì 21 febbraio 2013 00:32
A: Salvatore D'Antonio
Cc: 'Benoit Claise'; [email-masked];
[email-masked]
Oggetto: Re: secdir review of draft-ietf-ipfix-flow-selection-tech

Hi Salvatore:

Draft submission deadline for IETF 86 is next Monday, 25 February.
Any chance of getting the revised draft done before that, please?

Cheers, Nevil

On 12/02/13 8:41 PM, Salvatore D'Antonio wrote:
> Dear Nevil,
>
> Thanks for your e-mail. Regrettably I could not work to the Draft in the
> last two months because I was fully involved in the preparation of the
final
> reports of the research projects of my University.
> I just restarted to work to the document in order to implement the changes
> requested by Benoit and I plan to submit a new version early next week.
>
> Kind regards,
>
> Salvatore
>
>
> -----Messaggio originale-----
> Da: Nevil Brownlee [mailto:[email-masked]]
> Inviato: martedì 12 febbraio 2013 03:38
> A: Salvatore D'Antonio
> Cc: 'Benoit Claise'; [email-masked];
> [email-masked]
> Oggetto: Re: R: R: secdir review of draft-ietf-ipfix-flow-selection-tech
>
>
> Hi Salvatore:
>
> I'm getting set for IETF 86 in Orlando; I see that the flow-selection
> draft has been sitting waiting for a revised draft for 130 days!
>
> Please can you get that published real soon now, it would be really
> good to see this draft finally published!
>
> Cheers, Nevil
>
>
> On 20/11/12 5:32 AM, Salvatore D'Antonio wrote:
>> Dear Benoit,
>>
>>
>>
>> Ok, I will do.
>>
>>
>>
>> Thanks.
>>
>>
>>
>> Best regards,
>>
>>
>>
>>
>>
>> Salvatore
>>
>>
>>
>>
>>
>>
>>
>> Da: Benoit Claise [mailto:[email-masked]]
>> Inviato: lunedì 19 novembre 2012 17:16
>> A: Salvatore D'Antonio
>> Cc: [email-masked]
>> Oggetto: Re: R: secdir review of draft-ietf-ipfix-flow-selection-tech
>>
>>
>>
>> Salvatore,
>>
>> Please answer Dan's comment via email before posting the draft, unless
>> you're sure that your resolution will resolve his issue.
>>
>> Regards, Benoit
>>
>> Dear all,
>>
>>
>>
>> I missed Dan's e-mail. I apologise for that.
>>
>>
>>
>> I will address Dan's comments  in the new version of the Draft.
>>
>>
>>
>> Best regards,
>>
>>
>>
>> Salvatore
>>
>>
>>
>>
>>
>>
>>
>> Da: Benoit Claise [mailto:[email-masked]]
>> Inviato: lunedì 12 novembre 2012 17:51
>> A: [email-masked]
>> Cc: [email-masked]
>> Oggetto: Fwd: secdir review of draft-ietf-ipfix-flow-selection-tech
>>
>>
>>
>> Dear authors,
>>
>> Reading my old emails, I'm not sure that you took into account Dan's
>> feedback.
>> At the very minimum, you should give a reply
>>
>> Regards, Benoit
>>
>>
>>
>> -------- Original Message --------
>>
>>
>> Subject:
>>
>> secdir review of draft-ietf-ipfix-flow-selection-tech
>>
>>
>> Date:
>>
>> Tue, 10 Apr 2012 16:59:43 -0700 (PDT)
>>
>>
>> From:
>>
>> Dan Harkins  <mailto:[email-masked]> <[email-masked]>
>>
>>
>> To:
>>
>> [email-masked], [email-masked],
>> [email-masked]
>>
>>
>>
>>     Hello,
>>
>>     I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>>     This draft describes techniques to select flows which are sets of
>> packets with some common characteristics. The authors have accurately
>> identified what constitutes an attack-- an adversary having the ability
>> to influence flow selection-- and the Security Considerations give
>> a couple examples of this. They seem fine.
>>
>>     There is reference to a paper "[GoRe07]" which does not appear in the
>> References and seems to give advice that I think is wrong: use a strong
>> cryptographically strong random number generator to thwart an attack in
>> which parameters of time-based sampling are discovered to predict the
>> selection decision. This attack can be thwarted by using a value that
>> the adversary cannot predict (sort of like an IV for CBC mode) instead
>> of a cryptographically strong random number. That leaves the random
>> number pool to applications that really need it (like a key exchange
>> that does a Diffie-Hellman). I suggest removing the reference to the
>> un-referenced paper and mention a weaker requirement to thwart that
>> attack.
>>
>>     regards,
>>
>>     Dan.
>>
>>
>>
>>
>>
>>
>>
>>
>>     _____
>>
>> Nessun virus nel messaggio.
>> Controllato da AVG - www.avg.com
>> Versione: 2012.0.2221 / Database dei virus: 2441/5390 - Data di rilascio:
>> 12/11/2012
>>
>>
>>
>>     _____
>>
>> Nessun virus nel messaggio.
>> Controllato da AVG - www.avg.com
>> Versione: 2012.0.2221 / Database dei virus: 2629/5404 - Data di rilascio:
>> 18/11/2012
>>
>>
>
>

-- 
---------------------------------------------------------------------
  Nevil Brownlee                          Computer Science Department
  Phone: +64 9 373 7599 x88941             The University of Auckland
  FAX: +64 9 373 7453   Private Bag 92019, Auckland 1142, New Zealand
-----
Nessun virus nel messaggio.
Controllato da AVG - www.avg.com
Versione: 2013.0.2899 / Database dei virus: 2639/6120 -  Data di rilascio:
20/02/2013