Subject: Re: [tcpm] Fwd: New Version Notification for draft-touch-tcp-ao-nat-03.txt

From: Uma Chunduri <[email-masked]>
Date: Mon, 4 Jun 2012 14:51:37 -0400

I have gone through this document and this looks like an important problem to be addressed 
for deploying AO in client/server environments (where NAT is always a possibility).

Sorry, I was not following this list earlier. 
Can anybody summarize what were the  specific 
reasons (if any) for insufficient interest in the WG?

-- 
Uma C. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Joe Touch
Sent: Wednesday, May 30, 2012 4:05 PM
To: [email-masked]
Subject: [tcpm] Fwd: New Version Notification for draft-touch-tcp-ao-nat-03.txt

Hi, all,

I have submitted an updated version of TCP-AO NAT. It was updated with a new date and more recent citations.

As per discussions on this list, since there was insufficient interest in this WG, this document has been submitted for publication as an individual submission.

FYI.

Joe

-------- Original Message --------
Subject: New Version Notification for draft-touch-tcp-ao-nat-03.txt
Date: Wed, 30 May 2012 15:45:53 -0700
From: [email-masked]
To: [email-masked]

A new version of I-D, draft-touch-tcp-ao-nat-03.txt has been successfully submitted by Joe Touch and posted to the IETF repository.

Filename:	 draft-touch-tcp-ao-nat
Revision:	 03
Title:		 A TCP Authentication Option NAT Extension
Creation date:	 2012-05-30
WG ID:		 Individual Submission
Number of pages: 6

Abstract:
    This document describes an extension to the TCP Authentication
    Option (TCP-AO) to support its use over connections that pass
    through network address and/or port translators (NATs/NAPTs). This
    extension changes the data used to compute traffic keys, but does
    not alter TCP-AO&#39;s packet processing or key generation algorithms.

The IETF Secretariat
_______________________________________________
tcpm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tcpm

---

From: "Scharf, Michael (Michael)" <[email-masked]>
Date: Mon, 4 Jun 2012 21:04:02 +0200

We've asked several times in the past whether people are interested in the document, who is willing to review it, etc.

For instance, please have a look at this list thread: http://www.ietf.org/mail-archive/web/tcpm/current/msg06427.html

Michael

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Uma Chunduri
> Sent: Monday, June 04, 2012 8:52 PM
> To: Joe Touch; [email-masked]
> Subject: Re: [tcpm] Fwd: New Version Notification for 
> draft-touch-tcp-ao-nat-03.txt
> 
> I have gone through this document and this looks like an 
> important problem to be addressed for deploying AO in 
> client/server environments (where NAT is always a possibility).
> 
> Can anybody summarize what were the  specific reasons (if 
> any) for insufficient interest in the WG?
> 
> --
> Uma C. 
> 
> 
> I have submitted an updated version of TCP-AO NAT. It was 
> updated with a new date and more recent citations.
> 
> As per discussions on this list, since there was insufficient 
> interest in this WG, this document has been submitted for 
> publication as an individual submission.
> 
> FYI.
> 
> Joe
> 
> A new version of I-D, draft-touch-tcp-ao-nat-03.txt has been 
> successfully submitted by Joe Touch and posted to the IETF repository.
>

---

From: Uma Chunduri <[email-masked]>
Date: Mon, 4 Jun 2012 15:27:36 -0400

Thank you Michael. I am interested in this document. 
Though Routing Protocols (BGP/LDP etc..) using AO may not have this issue as these protocols messages 
are generally not NATed, client/server application in routing environments which use AO may encounter NAT boxes.
Essentially this will render  (light weight) AO not usable in those environments.  

I can review the document and post any specific comments I have in the list. I feel, 
this capability is important for more widespread use of AO.

-- 
Uma C. 

-----Original Message-----
From: Scharf, Michael (Michael) [mailto:[email-masked]] 
Sent: Monday, June 04, 2012 12:04 PM
To: Uma Chunduri; Joe Touch; [email-masked]
Subject: RE: [tcpm] Fwd: New Version Notification for draft-touch-tcp-ao-nat-03.txt

Michael

> From: [email-masked] [mailto:[email-masked]] On Behalf 
> Of Uma Chunduri
> I have gone through this document and this looks like an important 
> problem to be addressed for deploying AO in client/server environments 
> (where NAT is always a possibility).
> 
> As per discussions on this list, since there was insufficient interest 
> in this WG, this document has been submitted for publication as an 
> individual submission.
> 
> FYI.
> 
> Joe
>

---

From: Joe Touch <[email-masked]>
Date: Mon, 04 Jun 2012 15:34:13 -0700

Hi, all,

If there is enough interest to have this taken through the WG, please 
let me know.

Otherwise, as per previous direction, I'll continue on the independent path.

My goal is not to end-run, but it is to move forward.

Joe

---

From: "Scharf, Michael (Michael)" <[email-masked]>
Date: Mon, 11 Jun 2012 17:29:55 +0200

Uma,

The consensus in TCPM has been not to adopt the document, but this does not prevent the document from being published on the individual track.

Changing this decision would require significant support in the TCPM community.

I'd like to understand whether there is a new use case TCPM might not have been aware of before. You apparently argue that "client/server applicatious in routing environments" are different to routing protocols (BGP/LDP), right? Could you please elaborate on this use case and why this should affect the use of AO? For instance, I wonder whether there is a fundamental difference to a BGP route reflector, or whether TLS could be an alternative.

Thanks

Michael

> From: Uma Chunduri [mailto:[email-masked]] 
> Sent: Monday, June 04, 2012 9:28 PM
> To: Scharf, Michael (Michael); Joe Touch; [email-masked]
> Though Routing Protocols (BGP/LDP etc..) using AO may not 
> have this issue as these protocols messages are generally not 
> NATed, client/server application in routing environments 
> which use AO may encounter NAT boxes.
> I can review the document and post any specific comments I 
> have in the list. I feel, this capability is important for 
> more widespread use of AO.
> 
> --
> Uma C. 
> 
> 
> From: Scharf, Michael (Michael) 
> [mailto:[email-masked]] 
> We've asked several times in the past whether people are 
> interested in the document, who is willing to review it, etc.
> 
> For instance, please have a look at this list thread: 
> http://www.ietf.org/mail-archive/web/tcpm/current/msg06427.html
> 
> Michael
> 
> 
> > Of Joe Touch

---

From: Joe Touch <[email-masked]>
Date: Mon, 11 Jun 2012 08:37:18 -0700

FWIW, I think Uma is referring to RPKI. I had extended discussions in 
SIDR on this issue, regarding the maturity of TCP-AO for use for BGP 
route and policy key stores.

I suspect that TLS won't be sufficient; attacking the TCP connections of 
a keyserver that validates BGP routes could be as debilitating as 
attacking the BGP session itself.

However, I'm not clear on whether NAT access to such resources is 
critical. Uma might elaborate on that.

Joe