Subject: [ippm] WGLC: draft-ietf-ippm-ipsec-05.txt

From: Bill Cerveny <[email-masked]>
Date: Wed, 15 Oct 2014 14:39:46 -0400

A WGLC is being commenced for draft-ietf-ippm-ipsec until Saturday, November 1, 2014.  The authors are particularly interested in comments regarding changes made to the document since IETF90. These changed can be observed at:
https://www.ietf.org/rfcdiff?url1=draft-ietf-ippm-ipsec-04&difftype=--html&submit=Go%21&url2=draft-ietf-ippm-ipsec-05

Regards,

Bill Cerveny
IPPM WG co-chair

Begin forwarded message:

> From: [email-masked]
> Subject: [ippm] I-D Action: draft-ietf-ippm-ipsec-05.txt
> Date: September 19, 2014 at 10:35:17 AM EDT
> To: [email-masked]
> Cc: [email-masked]
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the IP Performance Metrics Working Group of the IETF.
> 
>        Title           : IKEv2-based Shared Secret Key for O/TWAMP
>        Authors         : Kostas Pentikousis
>                          Emma Zhang
>                          Yang Cui
> 	Filename        : draft-ietf-ippm-ipsec-05.txt
> 	Pages           : 12
> 	Date            : 2014-09-19
> 
> Abstract:
>   The O/TWAMP security mechanism requires that both the client and
>   server endpoints possess a shared secret.  Since the currently-
>   standardized O/TWAMP security mechanism only supports a pre-shared
>   key mode, large scale deployment of O/TWAMP is hindered
>   significantly.  At the same time, recent trends point to wider IKEv2
>   deployment which, in turn, calls for mechanisms and methods that
>   enable tunnel end-users, as well as operators, to measure one-way and
>   two-way network performance in a standardized manner.  This document
>   discusses the use of keys derived from an IKEv2 SA as the shared key
>   in O/TWAMP.  If the shared key can be derived from the IKEv2 SA, O/
>   TWAMP can support certificate-based key exchange, which would allow
>   for more operational flexibility and efficiency.  The key derivation
>   presented in this document can also facilitate automatic key
>   management.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-ippm-ipsec/
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-ietf-ippm-ipsec-05
> 
> A diff from the previous version is available at:
> http://www.ietf.org/rfcdiff?url2=draft-ietf-ippm-ipsec-05
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> ippm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ippm

---

From: Bill Cerveny <[email-masked]>
Date: Wed, 22 Oct 2014 11:52:37 -0400

[Resending to include ipsec e-mail list]

Regards,

Bill Cerveny
IPPM WG co-chair

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Sat, 25 Oct 2014 17:00:00 -0400

I see a small issue in this draft.
  
Although the proposal is applicable to both OWAMP and TWAMP,
we currently have no registry available to extend OWAMP and use
this new mode -- IOW, there is no IANA Registry for OWAMP Mode
bit positions.

In the near term, the draft could be positioned to extend TWAMP
and mention clear applicability to OWAMP (but no current way to
register the extension).

In the long term, IPPM could establish the Modes and Commands 
registries for OWAMP and (in the process) decide if we will try to simplify
life by coordinating bit positions for both -WAMPs (which would mean
going back and specifying the OWAMP equivalent of all the applicable
existing TWAMP Modes.

I'm fairly sure I mentioned this issue to Kostas in an exchange last month,
so it's not a complete surprise, and I'm sure we can work out the changes
to accomodate the missing OWAMP registry.

regards,
Al

________________________________________
From: ippm [[email-masked]] On Behalf Of Bill Cerveny [[email-masked]]
Sent: Wednesday, October 15, 2014 2:39 PM
To: [email-masked]
Subject: [ippm] WGLC: draft-ietf-ippm-ipsec-05.txt

A WGLC is being commenced for draft-ietf-ippm-ipsec until Saturday, November 1, 2014.  The authors are particularly interested in comments regarding changes made to the document since IETF90. These changed can be observed at:
https://www.ietf.org/rfcdiff?url1=draft-ietf-ippm-ipsec-04&difftype=--html&submit=Go%21&url2=draft-ietf-ippm-ipsec-05<https://www.ietf.org/rfcdiff?url1=draft-ietf-ippm-ipsec-04&difftype=--html&submit=Go!&url2=draft-ietf-ippm-ipsec-05>

Regards,

Bill Cerveny
IPPM WG co-chair

Begin forwarded message:

From: [email-masked]<mailto:[email-masked]>
Subject: [ippm] I-D Action: draft-ietf-ippm-ipsec-05.txt
Date: September 19, 2014 at 10:35:17 AM EDT
To: [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>

Abstract:

---

From: Kostas Pentikousis <[email-masked]>
Date: Tue, 28 Oct 2014 17:41:26 +0100

Dear Al, all,

| Although the proposal is applicable to both OWAMP and TWAMP, we
| currently have no registry available to extend OWAMP and use this new
| mode -- IOW, there is no IANA Registry for OWAMP Mode bit positions.
| 
| In the near term, the draft could be positioned to extend TWAMP and
| mention clear applicability to OWAMP (but no current way to register
| the extension).

I think it makes sense to add some text in the beginning of section 4 to clearly spell out this issue, and then in the remainder of section 4 use "TWAMP" instead of "O/TWAMP". We could update the draft as soon as the datatracker is open for uploads. Would this be ok? For example:

OLD:

This section presents a method of binding O/TWAMP and IKEv2 for network measurements between a client and a server which both support IPsec.  In short, the shared key used for securing O/TWAMP traffic is derived using IKEv2 [RFC5996]. 

NEW:

This section specifies a method of binding TWAMP and IKEv2 for network measurements between a client and a server which both support IPsec.  In short, the shared key used for securing TWAMP traffic is derived using IKEv2 [RFC5996]. This document reserves from the TWAMP-Modes registry the Mode value IANA.TBA.TWAMP.IKEv2Derived which MUST be used by TWAMP implementations compatible with this specification. Although an implementer MAY use this Mode value in an OWAMP implementation as well. It should be noted, however, that IANA does not currently maintain an IANA registry for OWAMP Mode values and, therefore, independent OWAMP implementations should be checked for full compatibility with respect to the use of this Mode value.

If you have specific text you would like to see included, please do not hesitate.

| In the long term, IPPM could establish the Modes and Commands
| registries for OWAMP and (in the process) decide if we will try to
| simplify life by coordinating bit positions for both -WAMPs (which
| would mean going back and specifying the OWAMP equivalent of all the
| applicable existing TWAMP Modes.

I think this makes a lot of sense and I would personally be happy to help in this effort. Perhaps a new draft for Dallas?

| 
| I'm fairly sure I mentioned this issue to Kostas in an exchange last
| month, so it's not a complete surprise, and I'm sure we can work out
| the changes to accomodate the missing OWAMP registry.

You're right Al. We did name the Mode as "IANA.TBA.TWAMP.IKEv2Derived" in this revision and the IANA considerations does mention only the TWAMP-Modes registry, but unfortunately we didn't add the aforementioned text which would have been optimal. Sorry about that.

Best regards,

Kostas

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Tue, 28 Oct 2014 16:55:50 -0400

Hi Kostas,

Two quick thoughts in response:

Although we may say some appropriate things in section 4,
this right place to take care of this is in a "Scope and Applicability"
section, where you could simply say that the control procedures
are applicable to OWAMP, but without a registry for Mode values
there is no way to extend OWAMP at the time of this writing.

And since this is a Standards Track extension of TWAMP, I don't 
think we will be able to encourage use of a specific Mode value
for OWAMP implementations - this "overhanging" the assignment
process is strongly frowned upon.  Until IETF and IANA take action,
arranging for use of this feature must be arranged privately among
consenting OWAMP users.  (I think that's roughly acceptable
language for situations like this.)

more later on the registry for OWAMP,
Al

________________________________________
From: Kostas Pentikousis [[email-masked]]
Sent: Tuesday, October 28, 2014 12:41 PM
To: MORTON, ALFRED C (AL); Bill Cerveny; [email-masked]
Subject: AW: [ippm] WGLC: draft-ietf-ippm-ipsec-05.txt

Dear Al, all,

OLD:

NEW:

|

Best regards,

Kostas