Subject: [privacydir] request for a SAVI doc review

From: Stephen Farrell <[email-masked]>
Date: Thu, 27 Oct 2011 17:07:05 +0100

Hi,

There's a SAVI document [1] on the Nov 3 telechat. I'd appreciate
a review of that from a privacy perspective if someone has the
time in the next week. (Just reply to this if you've time.)

Previous SAVI documents have generated privacy related
DISCUSSes [2,3] which may be useful background.

Thanks in advance,
S.

[1] https://datatracker.ietf.org/doc/draft-ietf-savi-framework/
[2] https://datatracker.ietf.org/doc/draft-ietf-savi-fcfs/
[3] https://datatracker.ietf.org/doc/draft-ietf-savi-threat-scope/

---

From: Ted Hardie <[email-masked]>
Date: Thu, 27 Oct 2011 11:52:30 -0700

I can take a look at it, but someone else from a different part of the stack
might be a good idea.

Any other volunteers?

Ted

On Thu, Oct 27, 2011 at 9:07 AM, Stephen Farrell
<[email-masked]>wrote:

> [1] https://datatracker.ietf.org/**doc/draft-ietf-savi-framework/<https://datatracker.ietf.org/doc/draft-ietf-savi-framework/>
> [2] https://datatracker.ietf.org/**doc/draft-ietf-savi-fcfs/<https://datatracker.ietf.org/doc/draft-ietf-savi-fcfs/>
> [3] https://datatracker.ietf.org/**doc/draft-ietf-savi-threat-**scope/<https://datatracker.ietf.org/doc/draft-ietf-savi-threat-scope/>
>
> ______________________________**_________________
> privacydir mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/privacydir<https://www.ietf.org/mailman/listinfo/privacydir>
>

---

From: "Richard L. Barnes" <[email-masked]>
Date: Thu, 27 Oct 2011 16:52:44 -0400

I already did a review of draft-ietf-savi-threat-scope back in June, which noted some major issues:
<http://www.ietf.org/mail-archive/web/privacydir/current/msg00039.html>

The document has not been updated since then, so those comments stand.

--Richard

On Oct 27, 2011, at 2:52 PM, Ted Hardie wrote:

> I can take a look at it, but someone else from a different part of the stack might be a good idea.
> 
> Any other volunteers?
> 
> Ted
> 
> On Thu, Oct 27, 2011 at 9:07 AM, Stephen Farrell <[email-masked]> wrote:
> 
> Hi,
> 
> _______________________________________________
> privacydir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/privacydir
> 
> _______________________________________________
> privacydir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/privacydir

---

From: Ted Hardie <[email-masked]>
Date: Mon, 31 Oct 2011 13:07:55 -0700

Hi Stephen,

I've read through the framework document.  My baseline impression is that
the document makes a presumption about the relationship between the host
and the network employing SAVI that is true when it is the access network
(that is, the network assigning the IP address to be verified).  In that
deployment scenario, it is expected for the network to be able to associate
layer two identifiers with the layer 3 identifier (after all, it must to be
able to deliver return traffic).

What's not clear to the naive reader (read: me) is how you prevent SAVI
from operating from other parts of the network; that is, how does the
overall framework guard against SAVI being used by some later network
on-path getting access to these bindings? I assume that this is detailed
elsewhere in the protocol documents, but I believe a short discussion of
the privacy threat in framework, along with a pointer to the protocol
mechanism would be valuable.

If the expectation is that SAVI can operate from multiple places in the
network (including, say, the destination network), then I believe there is
a more serious privacy concern.

regards,

Ted Hardie

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 01 Nov 2011 00:15:50 +0000

Ted,

Thanks for that, the insight is helpful.

Cheers,
S.