Subject: [IPFIX] Re: Implementation Guidelines status

From: Nevil Brownlee <[email-masked]>
Date: Fri, 2 Feb 2007 14:22:23 +1300

Hi Elisa:

> according to plan we should start Last Call on the Guidelines in 
> February. The main open issues were the security guidelines, which 
> were entirely missing. We do now have some security guidelines (two 
> implementations using TLS over TCP were available in Berlin). The 
> problem with the security guidelines at this point seems to be the 
> following: only OpenSSL implements DTLS and that implementation is 
> not mature (it requires hacks to have it working). Also SCTP 
> implementations are not widely mature; we had interoperability 
> problems between different platforms at the interop. (Linux, Mac and 
> Windows were available in Berlin).
> At this point I don't think that we can do much more...
> The real recommendation for implementers for the time being is to use 
> TLS over TCP if security is required
>
> Do you think this would be enough for Last Call? If yes, when would 
> the appropriate time be? Right now is Biflow in last call (even 
> though people haven't been too reactive it seems...) and from the 
> 12th of February I'll be on holidays for two weeks (back at work on 
> the 28th). Shall we postpone Last Call to March?

Yes, that sounds enough to me.  It doesn't matter whether or not
we have much experience of doing these things, as long as we can say
how to do them in a convincing way.  So I'd say, go ahead and publish
this version.  How about starting the WG Last Call on, say Friday
9 Feb?  That would mean you're back a few days after it ends, and
can make any suggested changes?  Then we could submit it to IESG before 
the Prague IETF.

Also, I've been looking at the Reducing Redundancy draft.  Are you
ready for a WG LC on that too?  I notice that it has minimal Security
Considerations ("same as for IPFIX Protocol") - maybe that needs a
little more, pointing out that DTLS is needed for PR-SCTP and UDP,
or TLS for SCTP and TCP, then referring to IPFIX-Protocol for more
detail?  Also, although that draft talks about PR-SCTP, it doesn't
say anything about SCTP (which by default is fully reliable).  How
about one more revision of the draft, talking about 'SCTP' (rather
than PR-SCTP) in the Transport section, and the remark about PR-SCTP
in the  Security Considerations section?

Cheers, Nevil

-----------------------------------------------------------------------
  Nevil Brownlee                    Computer Science Department | ITS
  Phone: +64 9 373 7599 x88941             The University of Auckland
  FAX: +64 9 373 7453   Private Bag 92019, Auckland 1142, New Zealand

-----------------------------------------------------------------------
This mail sent through University of Auckland http://www.auckland.ac.nz

_______________________________________________
IPFIX mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipfix

---

From: Nevil Brownlee <[email-masked]>
Date: Fri, 2 Feb 2007 14:22:23 +1300

Cheers, Nevil