Subject: [Detnet] FW: DetNet Security Team Meeting Notes 12Oct17

From: "Grossman, Ethan A." <[email-masked]>
Date: Thu, 12 Oct 2017 18:20:45 +0000

Since the DetNet Security draft is now a WG draft, here is an update. Any input from anyone is welcome.
Ethan.
--------------------------

1)      Henrik reviewed RFC 3552 (Guidelines for Writing RFC Text on Security Considerations). He concluded that we have basically covered the required material in our draft, however our document organization is somewhat different from what they prescribe. However, ours is a whole draft, not just a section, and theirs seems to be more oriented toward web-based applications, so it isn't a perfect fit for DetNet anyway. For now the plan is to leave our current organization unless we get strong guidance otherwise.

2)      RFC 3552 also suggests that if one is referencing specific technologies like HMAC that one should be specific, for example the specific types of hashes to be used. Our sense is that DetNet is intended to be a scalable set of tools, and we would not be prescriptive about such things, however we should include some statement about this, pointing out that differing use cases will require differing levels of encryption, for example, trading off CPU usage and latency for higher security.

3)      Question: should TSN-specific technologies be listed as mitigations? For example the 802.1Qbv time aware shaper can be used as a mitigation against Delay attacks. It seems like we should mention things like that somehow, but how do they fit into our draft structure?
---------------------------