Subject: [RTG-DIR] Rtgdir last call review of draft-ietf-roll-turnon-rfc8138-10

From: Stewart Bryant via Datatracker <[email-masked]>
Date: Fri, 14 Aug 2020 11:55:19 -0700

Reviewer: Stewart Bryant
Review result: Not Ready

I have been asked to review this by the Routing Directorate.

Summary

Although the are quite a few points below, a lot of them are editorials.
However I am a bit worried about the safety of the mechanism proposed which
seems to be rather more one-way that may be operationally safe.

Genarally the text is clear and well written.

Major Issues:

   In particular it is not the
   intention to undo the setting of the "T" flag.  Though it is possible
   to roll back (see Section 5.3), adding nodes that do not support
   [RFC8138] after a roll back may be problematic if the roll back did
   not fully complete.
SB> I see this as quite problematic. There are a number of reasons why you
might need to roll back: network merging, legacy nodes, bugs in the
implementation. I would think that you needed to be able to go backwards and
forwards, without difficulty and yet you give the impression that it really is
a one-way trip. I think that could be operationally problematic.

========

A node
   that cannot do so may remain connected to the network as a RUL, but
   how the node is modified to turn into a RUL is out of scope.
SB> That is quite worrying in practical deployments that this is not specified.

=======

   To ensure that a packet is forwarded across the RPL DODAG in the form
   in which it was generated, it is required that all the RPL nodes
   support [RFC8138] at the time of the switch.
SB> I am not sure if it is possible to implement the feature, but a safe
implementation would have them report that they support it and use that to
inhibit the setting of the T bit.

========
   When turning [RFC8138] compression off in the network, the Network
   Administrator MUST wait until all nodes have converged to the "T"
   flag reset before allowing nodes that do not support the compression
   in the network.
SB> How does it know that this has happened?

=========

7.  Security Considerations

   First of all, it is worth noting that with [RFC6550], every node in
   the LLN that is RPL-aware can inject any RPL-based attack in the
   network.  A trust model has to be put in place in an effort to
   exclude rogue nodes from participating to the RPL and the 6LoWPAN
   signaling, as well as from the data packet exchange.  This trust
   model could be at a minimum based on a Layer-2 Secure joining and the
   Link-Layer security.  This is a generic RPL and 6LoWPAN requirement,
   see Req5.1 in Appendix of [RFC8505].
SB> I am surprised there is not a MUST in the above considering the
vulnerability.

======

   An attacker in the middle of the network may reset the "T" flag to
   cause extra energy spending in its subDAG.  Conversely it may set the
   "T" flag, so that nodes located downstream would compress when that
   it is not desired, potentially resulting in the loss of packets.  In
   a tree structure, the attacker would be in position to drop the
   packets from and to the attacked nodes.  So the attacks above would
   be more complex and more visible than simply dropping selected
   packets.  The downstream node may have other parents and see both
   settings, which could raise attention.
SB> I am worried that there are no real mitigations to this. The attack may be
a bug.

=========

Minor Issues

   The suggested bit position of the "T" flag is indicated in Section 6.
SB> I know that you need to go through the IANA process, but future readers
SB> will find the text a lot easier to follow if the bit is included in
SB> Fig 1 above.
SB>
SB> Presumably the base spec sends with the T bit clear and thus the
SB> feature is disabled. It might not hurt to remind the reader of this as it
is what gives you the backwards compatibility.

========

   A router MUST uncompress a packet that is to be forwarded to an
   external target.
SB> Is there not a config option to retain compression to a consenting external
party?

========

6.  IANA Considerations

It would be clearer if there were an IANA/Editor request to also edit Fig 1

========

Nits/Editorials

Otherwise, a non-capable node acting as leaf-only would fail to
SB> would be clearer as non-RPL-capable

========

   communicate, and acting as a router it would drop the compressed
SB> Perhaps:  and if acting

========

   The idea is to use the flag to maintain the compression inactive
SB> Perhaps : The flag is cleared to maintain the compression inactive state

=========

   A node SHOULD source packets in the compressed form using [RFC8138]
SB> source or send?

==========

   The decision of using [RFC8138] is made by the originator of the
SB> the decision to use

==========

A router that encapsulates a packet is the
   originator of the resulting packet and is responsible to compress the
SB> for compressing

==========

In most cases, packets from and to an external target are
SB> "to and from" is more conventional English

==========

Enabling the [RFC8138] compression
   without a turn-on signaling requires a "flag day"; all nodes must be
   upgraded, and then the network can be rebooted with the [RFC8138]
   compression turned on.

SB> I am not sure my English is any better below, but the text could use a
little polish

Enabling the [RFC8138] compression without a turn-on signaling method requires
a "flag day"; by which time all nodes must be upgraded, and at which point the
network can be rebooted with the [RFC8138]compression turned on.

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 18 Aug 2020 13:32:20 +0000

Hello Stewart

Many thanks for your review! I will need your help and suggestion to progress on your major point below.

> SB> I see this as quite problematic. There are a number of reasons why

> SB> you might need to roll back: network merging, legacy nodes, bugs in the

> implementation. I would think that you needed to be able to go backwards

> and forwards, without difficulty and yet you give the impression that it really

> is a one-way trip. I think that could be operationally problematic.

We have to look at where we come form and where we're going.

1) RPL is used in very large networks, e.g., smart grid with (tens of) thousands of nodes. RFC 8138 was concerned with the technology not the deployment. As written it requires a flag day. Now, this is really, really operationally problematic in the above networks.

=> We're looking for a feasible improvement to enable RFC 8138 in a brown field.

2) RFC 8138 will me a mandated function in RPLv2, MOP >= 7, and the flag will be implicitly on at that time. RPLv2 will have capability exchanges. The work has started (draft-ietf-roll-capabilities). But it is complex, not something we can retrofit in RPLv1 like this flag. Think about doing something like the diffusion algorithm but on unreliable links, and with possibly a number of nodes that are dead or unreachable for a while. As it goes, we will not need a capability for RFC 8138 since it is an implicit part of being RPLv2.

=> we are looking for a simple and short term solution for RPLv1, not a toggle that will be used repeatedly, not a capability that will remain exposed forever.

Now, we all know of short term solutions that kept existing for many years, so I agree with the desire to be cautious and do whatever to allow roll back. Any suggestion from your part will be appreciated, let's see below

> SB> That is quite worrying in practical deployments that this is not specified.

Well it is elsewhere, suggestion to turn this into:

"A node that cannot do so may remain connected to the network as a RUL

as described in [draft-ietf-roll-unaware-leaves]."

> inhibit the setting of the T bit.

Absolutely. We initially considered the upcoming capabilities work for that, but that's too complicated for a retrofit.

So we defer to network management. A managed deployment needs to manage the level of software of the devices I the network, and upgrade them.

So we came up with this text:

"

     The idea is to use the flag to maintain the compression inactive during

      the migration phase. When the migration is complete (e.g., as known by

      network management and/or inventory), the flag is set and the compression

      is globally activated in the whole DODAG.

"

Should we add something?

> SB> How does it know that this has happened?

Then again we rely on network management.

Proposal to add the last sentence in the following paragraph in section

5.3.  Rolling Back

"

   in the network.  To that effect, whether the compression is active in

   a node SHOULD be exposed the node's management interface.

"

> vulnerability.

True, changing to

"

A trust model is REQUIRED in an effort to exclude rogue nodes...

"

> SB> I am worried that there are no real mitigations to this. The attack

> SB> may be a bug.

True enough. Setting the bits in a mixed network is what hurts most since otherwise all we are getting is uncompressed packets when they could be compressed. I'm trying to figure a mitigation but do not see one without a lot of additional complexity. But as you say that's a bug that needs to be found and fixed.

For in path attacks, the attacker that passed the link layer security can do that and a lot more.

> SB> I know that you need to go through the IANA process, but future

> SB> readers will find the text a lot easier to follow if the bit is

> SB> included in Fig 1 above.

True. There are other specs competing for flags, see https://tools.ietf.org/html/draft-ietf-roll-useofrplinfo-40 so I wanted to make sure IANA would grant the proposed bit. Just got confirm from IANA and modified as follows (sorry if renders inadequately with your font:

0                   1                   2                   3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

|   Type = 0x04 |Opt Length = 14| | |T| |A|       ...           |

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                     +

|                               <- Flags ->       ...           |

> SB> feature is disabled. It might not hurt to remind the reader of this

> SB> as it is what gives you the backwards compatibility.

Yes. Proposed change (now that IANA conformed position 2 for us):

"

   This specification defines a new flag "Enable RFC8138 Compression"

   (T).  The "T" flag is set to turn-on the use of the compression of

   RPL artifacts with [RFC8138] within the DODAG.  The new "T" flag is

   encoded in position 2 of the reserved Flags field in the RPL DODAG

   Configuration Option, and set to 0 in legacy implementations as

   specified in Section 6.7.6 of [RFC6550].

"

> SB> Is there not a config option to retain compression to a consenting

> SB> external party?

We had one that we removed very recently to simplify the code.

Point is, RFC 8138 is very specific to compress RPL artifacts, so it makes sense within a RPL domain but not that much outside. For instance, the compression requires a knowledge of the RPL Root as a compression reference of the prefix.

> It would be clearer if there were an IANA/Editor request to also edit Fig 1

Since I made the edition, I added commented text indicating that if the flag position is changed then fig 1 and the text below are impacted.

> SB> would be clearer as non-RPL-capable

Actually the referred capability was the compression. Reworded the section as

"

   The packet compression technique defined in [RFC8138] can only be

   activated in a RPL [RFC6550] network when all the nodes support it.

   Otherwise, if acting as a leaf, a node that does not support the

   compression would fail to communicate; if acting as a router it would

   drop the compressed packets and black-hole a portion of the network.

"

> SB> Perhaps:  and if acting

Incorporated in the above change.

> SB> Perhaps : The flag is cleared to maintain the compression inactive

> SB> state

Done

> SB> source or send?

What about generate? We mean, as opposed to forward, afraid that send could be confusing.

> SB> the decision to use

Done

SB> for compressing

Done

> SB> "to and from" is more conventional English

Done

> SB> I am not sure my English is any better below, but the text could use

> SB> a

> little polish

My Polish is even worse than my English...

> Enabling the [RFC8138] compression without a turn-on signaling method

> requires a "flag day"; by which time all nodes must be upgraded, and at which

> point the network can be rebooted with the [RFC8138] compression turned on.

I picked your formulation, many thanks : )

The temporary changes for the proposed modifications are visible here:

https://github.com/roll-wg/roll-turnon-rfc8138/commit/2be6077441ecb3cdb3fba33303413c57fc9a78a8

Please let me know if we need more work here.

Again, many thanks Stewart!

Keep safe,

Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 27 Aug 2020 12:03:30 +0000

Dear Stewart

I did not see a confirm that you received this, that was not so long ago anyway, but just to follow up.

Your comments were rightful but not necessarily easy to address. I took a chance at them, but really need your advice to progress.

I just published 11 that has the proposed changes below and also addresses another review by Nagendra.

Please let me know how that goes.

Take care,

Pascal

From: Pascal Thubert (pthubert)
Sent: mardi 18 août 2020 15:32
To: 'Stewart Bryant' <[email-masked]>; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: RE: Rtgdir last call review of draft-ietf-roll-turnon-rfc8138-10

Hello Stewart

"

"

Should we add something?

5.3.  Rolling Back

"

"

True, changing to

"

"

0                   1                   2                   3

|                               <- Flags ->       ...           |

"

"

"

"

Done

Done

SB> for compressing

Done

Done

Keep safe,

Pascal

Subject: [Roll] I-D Action: draft-ietf-roll-turnon-rfc8138-11.txt
From: "[email-masked]" <[email-masked]>
To: "[email-masked]" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Date: Thu, 27 Aug 2020 12:00:09 +0000
List-Id: Routing Over Low power and Lossy networks <roll.ietf.org>

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Routing Over Low power and Lossy networks WG of the IETF.

        Title           : A RPL DODAG Configuration Option for the 6LoWPAN Routing Header
        Authors         : Pascal Thubert
                          Li Zhao
        Filename        : draft-ietf-roll-turnon-rfc8138-11.txt
        Pages           : 9
        Date            : 2020-08-27

Abstract:
   This document updates RFC 8138 by defining a bit in the RPL DODAG
   Configuration Option to indicate whether compression is used within
   the RPL Instance, and specify the behavior of RFC 8138-capable nodes
   when the bit is set and reset.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-roll-turnon-rfc8138/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-roll-turnon-rfc8138-11
https://datatracker.ietf.org/doc/html/draft-ietf-roll-turnon-rfc8138-11

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-roll-turnon-rfc8138-11

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
Roll mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/roll

---

From: Alvaro Retana <[email-masked]>
Date: Thu, 27 Aug 2020 08:41:01 -0700

On August 27, 2020 at 8:03:52 AM, Pascal Thubert wrote:

Hi!

> I just published 11 that has the proposed changes below

Looking at those changes, there's only one thing that doesn't work for me.

...
> A trust model is REQUIRED in an effort to exclude rogue nodes...

The resulting paragraph now reads:

   First of all, it is worth noting that with [RFC6550], every node in
   the LLN that is RPL-aware can inject any RPL-based attack in the
   network.  A trust model is REQUIRED in an effort to exclude rogue
   nodes from participating to the RPL and the 6LoWPAN signaling, as
   well as from the data packet exchange.  This trust model could at a
   minimum be based on a Layer-2 Secure joining and the Link-Layer
   security.  This is a generic RPL and 6LoWPAN requirement, see Req5.1
   in Appendix of [RFC8505].

Normatively requiring a trust model in this document doesn't work for
me for several reasons:

(1) The text points at a vulnerability present in all rfc6550
deployments, not something new to this document.  The paragraph is
used to set up the discussion in the rest of the section.

(2) There is no specific trust model to test compliance with; instead,
the text is tentative: "trust model could at a minimum be based
on...".  If we're going to make something REQUIRED, then we should be
able to point at what that is.

(3) The last sentence says that the trust model is already a "generic
RPL and 6LoWPAN requirement", which supports, even more, the point
about the issue not being specific to this document.

These reasons, and the fact that authorization doesn't prevent a node
from becoming rogue, led me to initially suggest not using MUST (in my
review of -07).

Having said all that, we should also explicitly point at the security
of the base spec.  I would even go for something simpler:

Suggestion>

   It is worth noting that with [RFC6550], every node in the LLN that is
   RPL-aware can inject any RPL-based attack in the network.  This document
   assumes that the security mechanisms as defined in [RFC6550] are followed.

Thanks!

Alvaro.

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 27 Aug 2020 17:05:07 +0000

Hello Alvaro 😊

I see your point. 

>    assumes that the security mechanisms as defined in [RFC6550] are followed.

This should be clarified a little bit. RPL has a security mechanism that to my best knowledge no one uses (https://tools.ietf.org/html/rfc6550#section-10).
What everyone uses is a Layer 2 access security. The text above seems to recommend to use RPL's secured mode. Is there a way to reword that a bit?

Take care,

Pascal

---

From: Alvaro Retana <[email-masked]>
Date: Thu, 27 Aug 2020 13:17:30 -0400

Sure…

I just to want to recommend anything that is not already specified
somewhere else for RPL.  :-)

On August 27, 2020 at 1:05:39 PM, Pascal Thubert (pthubert) (
[email-masked]) wrote:

Hello Alvaro 😊

I see your point.

> assumes that the security mechanisms as defined in [RFC6550] are
followed.

This should be clarified a little bit. RPL has a security mechanism that to
my best knowledge no one uses (
https://tools.ietf.org/html/rfc6550#section-10).
What everyone uses is a Layer 2 access security. The text above seems to
recommend to use RPL's secured mode. Is there a way to reword that a bit?

Take care,

Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 27 Aug 2020 17:45:03 +0000

Hello again Alvaro

We had a pass on similar text (with Benjamin K.) for the IESG review of https://tools.ietf.org/html/draft-ietf-6lo-fragment-recovery-21 (now in RFC ED queue) and ended up with

   As indicated in [FRAG-FWD<https://tools.ietf.org/html/draft-ietf-6lo-fragment-recovery-21#ref-FRAG-FWD>], Secure joining and the Link-Layer
   security are REQUIRED to protect against those attacks, as the
   fragmentation protocol does not include any native security
   mechanisms.

Indeed this requirement is common to anything 6LoWPAN or RPL. And MUSTing it in the form above seemed to reach consensus.
In the case of RPL alone it’s either as above or one of RPL’s secured modes, preinstalled of authenticated. RPL’s security section discusses the last to but does not really say what to do with Unsecured. We could fill that gap.

What about combining all this as:
“
It is worth noting that with [RFC6550], every node in the LLN that is RPL-aware can inject any RPL-based attack in the network.
This document assumes that the RPL exchange are protected against on-link attacks such as forged and replayed packets.
Section 10 of [RPL] proposes 3 security modes, Unsecured, Preinstalled and Authenticated.
In the Unsecured Mode, secure joining and the Link-Layer security are REQUIRED to protect against those attacks.
“

Keep safe,

Pascal
From: Alvaro Retana <[email-masked]>
Sent: jeudi 27 août 2020 19:18
To: Pascal Thubert (pthubert) <[email-masked]>; Stewart Bryant <[email-masked]>
Cc: [email-masked]
Subject: RE: [RTG-DIR] Rtgdir last call review of draft-ietf-roll-turnon-rfc8138-10

Sure…

I just to want to recommend anything that is not already specified somewhere else for RPL.  :-)

On August 27, 2020 at 1:05:39 PM, Pascal Thubert (pthubert) ([email-masked]<mailto:[email-masked]>) wrote:
Hello Alvaro 😊

I see your point.

Take care,

Pascal

---

From: Alvaro Retana <[email-masked]>
Date: Thu, 27 Aug 2020 12:45:01 -0700

Pascal:

The link-layer security is a mechanism that applies to all the RPL
messages.  It doesn’t just apply to messages associated with this
document.  Making it required (or even just normatively recommending it) in
this document feels like overreaching because we’re just defining a flag,
not changing how the RPL adjacency works.

I rather go with something akin to the Security Considerations in, for
example, draft-ietf-roll-efficient-npdao (also approved by Ben)…which is
where I borrowed the "This document assumes that the security mechanisms as
defined in [RFC6550] are followed…” phrase from.

BTW, we should at least point the reader to the Security Considerations in
rfc6550 and rfc8138.

Thanks!

Alvaro.

On August 27, 2020 at 1:45:09 PM, Pascal Thubert (pthubert) (
[email-masked]) wrote:

Hello again Alvaro

We had a pass on similar text (with Benjamin K.) for the IESG review of
https://tools.ietf.org/html/draft-ietf-6lo-fragment-recovery-21 (now in RFC
ED queue) and ended up with

   As indicated in [FRAG-FWD
<https://tools.ietf.org/html/draft-ietf-6lo-fragment-recovery-21#ref-FRAG-FWD>],
Secure joining and the Link-Layer

   mechanisms.

Indeed this requirement is common to anything 6LoWPAN or RPL. And MUSTing
it in the form above seemed to reach consensus.

In the case of RPL alone it’s either as above or one of RPL’s secured
modes, preinstalled of authenticated. RPL’s security section discusses the
last to but does not really say what to do with Unsecured. We could fill
that gap.

“

It is worth noting that with [RFC6550], every node in the LLN that is
RPL-aware can inject any RPL-based attack in the network.

This document assumes that the RPL exchange are protected against on-link
attacks such as forged and replayed packets.

Section 10 of [RPL] proposes 3 security modes, Unsecured, Preinstalled and
Authenticated.

In the Unsecured Mode, secure joining and the Link-Layer security are
REQUIRED to protect against those attacks.

“

Keep safe,

Pascal

*From:* Alvaro Retana <[email-masked]>
*Sent:* jeudi 27 août 2020 19:18
*To:* Pascal Thubert (pthubert) <[email-masked]>; Stewart Bryant <
[email-masked]>
*Cc:* [email-masked]
*Subject:* RE: [RTG-DIR] Rtgdir last call review of
draft-ietf-roll-turnon-rfc8138-10

Sure…

Hello Alvaro 😊

I see your point.

Take care,

Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 27 Aug 2020 20:38:20 +0000

Hello Alvaro

The point is if the security measures in RPL are not turned on, it’s either L2 security or none at all.

Shouldn’t we mandate L2 security in that case?

The quote from NP DAO is imprecise in that the security section in RPL only discusses the secured modes.  RFC 6550 says nothing in case of unsecured because we expected secured. It fails to recommend L2 security. The NPDAO text this inherits that gap.

The real world decided otherwise  and uses L2 security ubiquitously. Shouldn’t we reflect that ? Saying that we expect RPL security is a denial of the world around us.

So I’m good with your proposal but I feel the gap should be closed somewhere.  Agreed this is but a side spec, but then where should that be?

Take care,

Pascal

Le 27 août 2020 à 21:45, Alvaro Retana <[email-masked]> a écrit :

Pascal:

The link-layer security is a mechanism that applies to all the RPL messages.  It doesn’t just apply to messages associated with this document.  Making it required (or even just normatively recommending it) in this document feels like overreaching because we’re just defining a flag, not changing how the RPL adjacency works.

I rather go with something akin to the Security Considerations in, for example, draft-ietf-roll-efficient-npdao (also approved by Ben)…which is where I borrowed the "This document assumes that the security mechanisms as defined in [RFC6550] are followed…” phrase from.

BTW, we should at least point the reader to the Security Considerations in rfc6550 and rfc8138.

Thanks!

Alvaro.

On August 27, 2020 at 1:45:09 PM, Pascal Thubert (pthubert) ([email-masked]<mailto:[email-masked]>) wrote:
Hello again Alvaro

Keep safe,

Pascal
From: Alvaro Retana <[email-masked]<mailto:[email-masked]>>
Sent: jeudi 27 août 2020 19:18
To: Pascal Thubert (pthubert) <[email-masked]<mailto:[email-masked]>>; Stewart Bryant <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: RE: [RTG-DIR] Rtgdir last call review of draft-ietf-roll-turnon-rfc8138-10

Sure…

I see your point.

Take care,

Pascal

---

From: Alvaro Retana <[email-masked]>
Date: Thu, 27 Aug 2020 13:45:43 -0700

Hi!

If we want to close the gap, it should probably be in a document that
Updates rfc6550.   Or maybe the WG wants to wait until RPLv2 and do it
there…

:-)

Take care!

Alvaro.

On August 27, 2020 at 4:38:24 PM, Pascal Thubert (pthubert) (
[email-masked]) wrote:

Hello Alvaro

The point is if the security measures in RPL are not turned on, it’s either
L2 security or none at all.

The quote from NP DAO is imprecise in that the security section in RPL only
discusses the secured modes.  RFC 6550 says nothing in case of unsecured
because we expected secured. It fails to recommend L2 security. The NPDAO
text this inherits that gap.

The real world decided otherwise  and uses L2 security ubiquitously.
Shouldn’t we reflect that ? Saying that we expect RPL security is a denial
of the world around us.

So I’m good with your proposal but I feel the gap should be closed
somewhere.  Agreed this is but a side spec, but then where should that be?

Take care,

Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Fri, 28 Aug 2020 08:56:42 +0000

OK then, Alvaro. I’ll do that change.

The bottom line is that this draft addresses a brown field and will not change the arrangements as deployed, so it does not really matter what we say. Maybe it does not hurt to mention that as well does it?

The result would be:
“
   It is worth noting that with RPL <xref target='RFC6550'/>, every node in the
   LLN that is RPL-aware can inject any RPL-based attack in the network.
   This document applies typically to an existing deployment and does not change
   its security requirements and operations.
   It is assumed that the security mechanisms as defined for RPL are followed.
“

This is undoing what Stewart recommended (uppercase). But Stewart is CC so he can come back to us.
In the meantime I made as you suggest in github: https://github.com/roll-wg/roll-turnon-rfc8138/commit/1384773f2f965cdcb6b3fb39c72aed505202702b

Do you prefer I publish already?

Take care,

Pascal

From: Alvaro Retana <[email-masked]>
Sent: jeudi 27 août 2020 22:46
To: Pascal Thubert (pthubert) <[email-masked]>
Cc: [email-masked]; Stewart Bryant <[email-masked]>
Subject: Re: [RTG-DIR] Rtgdir last call review of draft-ietf-roll-turnon-rfc8138-10

Hi!

If we want to close the gap, it should probably be in a document that Updates rfc6550.   Or maybe the WG wants to wait until RPLv2 and do it there…

:-)

Take care!

Alvaro.

On August 27, 2020 at 4:38:24 PM, Pascal Thubert (pthubert) ([email-masked]<mailto:[email-masked]>) wrote:
Hello Alvaro

Take care,

Pascal