Subject: Re: [sfc] Eric Rescorla's Discuss on draft-ietf-sfc-nsh-24: (with DISCUSS and COMMENT)

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Mon, 16 Oct 2017 16:24:04 +0000

Many thanks for the continued dialogue, Kathleen!!!

Kathleen, Eric,

Just a heads up that we are almost finished with a proposal for the Security Considerations that we are targeting to address the concerns. More soon, and while we look forward to your comments on that proposal, in the mean time:

Eric, we have not heard from you on any of the two messages we sent addressed to you.

Kathleen, one comment and one question inline.

> Kathleen Moriarty <[email-masked]> wrote:
>  
> While
> the expressions EKR includes below are not directly in the draft, this
> is how we read it, 

This statement seems to characterize the review / reviewers, more than the document itself.

>   If MPLS is used similarly instead, yes, it
> will have the same issues, but you also won't have a secure option if
> this is done with the same security (or lack thereof) as MPLS.

I am not sure I fully understand the source, provenance, and implications of this comment. I do not recall MPLS being discussed before in the context of this document.

RFC 7365 describes the use of both MPLS and IP in Data Center (DC) Network Virtualization. Today, some of these packets flow already in existing DCs, and service chaining exists in those DCs. Is there some additional requirement for DC data planes, or for NVO3, that is not captured elsewhere?

More importantly: a corollary of what you are saying is that, providing a security option underneath in the tunneling adds to the overall security posture, and that MPLS is different than IP in this context. Does that capture your intent?

> Best regards,
> Kathleen

Best,

— Carlos P.

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 16 Oct 2017 09:27:17 -0700

On Mon, Oct 16, 2017 at 9:24 AM, Carlos Pignataro (cpignata) <
[email-masked]> wrote:

> Just a heads up that we are almost finished with a proposal for the
> Security Considerations that we are targeting to address the concerns. More
> soon, and while we look forward to your comments on that proposal, in the
> mean time:
>

Yeah, these got back-burnered because I had understood you were going to
make substantive changes to actually add an integrity feature and I was
intending to review the draft at that time. Is your plan not to do that?

-Ekr

> I am not sure I fully understand the source, provenance, and implications
> of this comment. I do not recall MPLS being discussed before in the context
> of this document.
>
> RFC 7365 describes the use of both MPLS and IP in Data Center (DC) Network
> Virtualization. Today, some of these packets flow already in existing DCs,
> and service chaining exists in those DCs. Is there some additional
> requirement for DC data planes, or for NVO3, that is not captured elsewhere?
>
> More importantly: a corollary of what you are saying is that, providing a
> security option underneath in the tunneling adds to the overall security
> posture, and that MPLS is different than IP in this context. Does that
> capture your intent?
>
> >
> > Best regards,
> > Kathleen
>
> Best,
>
> — Carlos P.
>
>

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Mon, 16 Oct 2017 17:12:30 +0000

On Oct 16, 2017, at 12:27 PM, Eric Rescorla <[email-masked]<mailto:[email-masked]>> wrote:

On Mon, Oct 16, 2017 at 9:24 AM, Carlos Pignataro (cpignata) <[email-masked]<mailto:[email-masked]>> wrote:
Many thanks for the continued dialogue, Kathleen!!!

Kathleen, Eric,

Yeah, these got back-burnered

We understand this DISCUSSion happens through dialogue — not guessing or mandate.

because I had understood you were going to make substantive changes to actually add an integrity feature

Sorry if we were not clear.

We are indeed working on changes, some potentially substantive — but somehow I missed this: can you please point me to the record where there’s a decision or discussion to “add an integrity feature”?

We are working through a more thorough threat analysis and describing the implications and solutions for each of those cases.

and I was intending to review the draft at that time. Is your plan not to do that?

We would have liked to have responses to our comments or questions, discussion via dialogue, to incorporate in the updates and potentially substantive set of changes. The plan is (now) provide a textual proposal.

That said, sure: you can review the forthcoming set of changes.

— Carlos.

-Ekr

> Kathleen Moriarty <[email-masked]<mailto:[email-masked]>> wrote:
>
> While

Best,

— Carlos P.

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 16 Oct 2017 10:16:31 -0700

On Mon, Oct 16, 2017 at 10:12 AM, Carlos Pignataro (cpignata) <
[email-masked]> wrote:

>
> On Oct 16, 2017, at 12:27 PM, Eric Rescorla <[email-masked]> wrote:
>
>
>
> We are indeed working on changes, some potentially substantive — but
> somehow I missed this: can you please point me to the record where there’s
> a decision or discussion to “add an integrity feature”?
>

That was my take-home from the telechat where this was discussed, but maybe
Alia would like to say what her understanding was.

-Ekr

> We are working through a more thorough threat analysis and describing the
> implications and solutions for each of those cases.
>
> We would have liked to have responses to our comments or questions,
> discussion via dialogue, to incorporate in the updates and potentially
> substantive set of changes. The plan is (now) provide a textual proposal.
>
>> RFC 7365 describes the use of both MPLS and IP in Data Center (DC)
>> Network Virtualization. Today, some of these packets flow already in
>> existing DCs, and service chaining exists in those DCs. Is there some
>> additional requirement for DC data planes, or for NVO3, that is not
>> captured elsewhere?
>>

---

From: Alia Atlas <[email-masked]>
Date: Thu, 19 Oct 2017 14:51:07 -0400

Eric,

The concern in the Discusses from Kathleen & you is around integrity
protection.
There are no encapsulations from the Routing Area that require integrity
protection that I am aware of;
when privacy is required IPsec or MAC sec are used.
I am continuing to encourage discussion on what is the threat model and
what technology are possible.
While I have been primarily engaging with Kathleen, given that you have a
separate Discuss, I would strongly
encourage your responsive participation.

There is certainly not consensus to add integrity protection from the
authors or WG.
The ramifications of doing so are quite severe and understanding of the
actual threat models that would
force that direction

Regards,
Alia

On Mon, Oct 16, 2017 at 1:16 PM, Eric Rescorla <[email-masked]> wrote:

> That was my take-home from the telechat where this was discussed, but
> maybe Alia would like to say what her understanding was.
>
> -Ekr
>
>
>>> I am not sure I fully understand the source, provenance, and
>>> implications of this comment. I do not recall MPLS being discussed before
>>> in the context of this document.
>>>
>>> More importantly: a corollary of what you are saying is that, providing
>>> a security option underneath in the tunneling adds to the overall security
> _______________________________________________
> sfc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sfc
>
>