Subject: [ippm] comments on draft-ietf-ippm-twamp-02.txt: security alignment with OWAMP

From: Matthew J Zekauskas <[email-masked]>
Date: Sat, 27 Jan 2007 00:53:25 -0500

So, the authors would like us to last call the TWAMP document, so I've
been re-reading, mostly to understand the relationship to OWAMP with
respect to the security changes that were inserted during discussion
with the Security Area Directors during IETF last call.

I believe that we could use additional readers on this document, as
there were substantive changes in addition to the attempted alignment
with OWAMP in this version.

I find that this document is still not completely aligned.  It's better
than before, but the changes in the authenticated and encrypted test
protocols did not make it into this version.

In particular (and I mentioned this broadly in my message on the last
version) this document still has IZP instead of MBZ in the test
protocol, and although it references section 3.2 (Integrity Protection)
of RFC 4656, it does not include HMAC in the packet format of TWAMP-Test
(authenticated and encrypted forms).

One thing that carries over from the last version (and that I did not
flag at the time) is the mention in section 4.2.1 that "In authenticated
mode, the first block (32 octets) of each packet is encrypted using AES
Electronic Cookbook (ECB) mode."  However, the first block is 16 bytes,
as mentioned in 4656, as well as earlier in this document (Section 4.2).

I'm also a little uncomfortable with the simple statement that "The
security considerations of OWAMP [RFC4656] apply.".  This is true.
However, do the changes with respect to reflection create any new
opportunities?  I have to say that I haven't re-read with this
specifically in mind, which is why I say "little uncomfortable", but
it's worth some thought, and perhaps a statement as to why no additional
(or different) considerations apply.

--Matt

_______________________________________________
ippm mailing list
[email-masked] 
https://www1.ietf.org/mailman/listinfo/ippm