Subject: Re: [ippm] Use TLS in TWAMP-Control?

From: Al Morton <[email-masked]>
Date: Fri, 20 Feb 2009 16:17:38 -0500

At the last IPPM meeting, I was asked to re-send this
to the list, to see if it might prompt any additional
discussion ...

At 10:19 AM 11/9/2008, Al Morton wrote:
>IPPM folks,
>
>At the last IPPM session in Dublin, we had a short discussion
>on TWAMP security in the context of the various TWAMP extensions
>proposed there:
>
> From http://www.ietf.org/proceedings/08jul/minutes/ippm.txt
>>
>>Discussion about TWAMP security
>>- Lars: Formerly there were some strong security concerns about OWAMP,
>>   but allowed to go through.  Building TWAMP on OWAMP raised those
>>   concerns again.  Are extensions like this going to raise more
>>   concerns?  What can be done to make security people happier?
>>- Al: Going to have to ask security people what their concerns are.
>>- Henk, Stas: Do not have records of reservations from security people.
>
>I took the opportunity to discuss the proposed extensions
>with Pasi Eronen one evening in Dublin. To briefly summarize,
>Pasi did not have concern with the proposed TWAMP features, but suggested
>that IPPM take a look at using TLS in the TWAMP Control protocol
>and assess the interest to implement a TLS-Control option if
>it were available. I agreed to re-initiate the investigation and
>discussion, and that's what I'm doing now...
>
>I put a few slides together and posted them here temporarily:
>http://wftp3.itu.int/packet/Background%20Docs/TLS_in_TWAMP_1108.ppt
>I've only looked at the initial Control session set-up impact.
>We can discuss this topic on the list, and perhaps if there's time
>on the IPPM agenda, perhaps we can spend a few minutes there as well.
>
>Some of the issues with using TLS in OWAMP-Control are identified in
>http://tools.ietf.org/html/rfc4656#section-6.6
>
>Another resource is a draft from the NETCONF wg:
>http://tools.ietf.org/html/draft-ietf-netconf-tls-06
>This memo describes how to use TLS to secure NETCONF.
>There are some clear synergies between NETCONF and TWAMP-Control,
>but
>1,$ s/NETCONF/TWAMP-Control/g
>isn't going to do it for us.  :-D
>
>regards,
>Al