Subject: Re: [secdir] secdir review of draft-ietf-tsvwg-port-use

From: Joe Touch <[email-masked]>
Date: Mon, 02 Feb 2015 10:29:34 -0800

Hi, Dan,

It should be easy to add DTLS where TLS is cited. IPsec is an 
interesting issue; I can add a few sentences to the security 
considerations area about that - e.g., that IPsec protects in a 
different way than TLS/DTLS, and that one key aspect of its 
configuration is port-specific parameters, which means it may be 
difficult to use separate IPsec policies on different services unless 
their port numbers are known and fixed in advance (even if using dynamic 
port numbers).

That latter is probably 2-3 short sentences, and I think would be 
worthwhile.

Joe

On 1/30/2015 4:04 PM, Dan Harkins wrote:
>
>    Hello,
>
>    I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
>    This draft provides some advice and recommendations on protocol
> port use to application and service designers. It has a nice, brief
> history of port usage and a nice list of guiding principles to help
> conserve port space. It will make a nice BCP. In my opinion it is Ready
> For Publication. With that said, I do have a small comment. In section
> 7.4 the draft says that TLS should be used to protect services that do
> not provide their own security directly. It might be worth while adding
> mention of DTLS and IPsec. And if the latter is not something that
> should be recommended then justification for that stance should be
> given.
>
>    regards,
>
>    Dan.
>

---

From: "Dan Harkins" <[email-masked]>
Date: Mon, 2 Feb 2015 16:17:52 -0800 (PST)

Hi Joe,

> their port numbers are known and fixed in advance (even if using dynamic

  There's also the issue that even if it uses fixed ports the app has
no assurance that IPsec will even be protecting it. From the app's
perspective it's basically write-and-pray.

> That latter is probably 2-3 short sentences, and I think would be

  That would be great and would address my comment.

  regards,

  Dan.

---

From: Joe Touch <[email-masked]>
Date: Mon, 02 Feb 2015 16:55:25 -0800

> perspective it's basically write-and-pray.

Yes, thanks for pointing that out. I'll add that too.

>   That would be great and would address my comment.

AOK - thanks again!

Joe