Subject: [ipwave] Genart last call review of draft-ietf-ipwave-ipv6-over-80211ocb-46

From: Roni Even via Datatracker <[email-masked]>
Date: Sun, 16 Jun 2019 01:52:23 -0700

Reviewer: Roni Even
Review result: Almost Ready

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.  Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.

Document: draft-ietf-ipwave-ipv6-over-80211ocb-??
Reviewer: Roni Even
Review Date: 2019-06-16
IETF LC End Date: 2019-06-26
IESG Telechat date: Not scheduled for a telechat

Summary:
The document is almost ready for publication as a standard track RFC

Major issues:

Minor issues:

1. Section 4.2  says "IP packets MUST be transmitted over 802.11-OCB media as
QoS Data" while appendix F say "The STA may send data frames of subtype Data,
Null, QoS Data, and
      QoS Null.".

2. In section 5.2 "The policy dictating when the MAC address is changed on the
802.11-OCB interface is to-be-determined.". Reading the next sentence it looks
to me that this is needed as part of the solution and should not be left for
the unknown future.

3. In Appendix I 4th paragraph " However, this does not apply if TBD TBD TBD. "
. What are the TBDs?

Nits/editorial comments:
1. In appendix I last paragraph "Support of RFC 8505 is may be implemented on
OCB." should be "Support of RFC 8505 may be implemented on OCB." 2. In Appendix
I "OCB nodes that support RFC 8505 would support the 6LN operation in order to
act as a host".  I think that instead of "would" it should be "should"  also if
this is a recommendation why not have this paragraph not in an appendix with
"MAY" and "SHOULD"

---

From: NABIL BENAMAR <[email-masked]>
Date: Mon, 17 Jun 2019 10:48:21 +0100

Dear Roni,

Thank you for your review.
Please, see my answers below.

On Sun, Jun 16, 2019, 09:52 Roni Even via Datatracker <[email-masked]>
wrote:

>       QoS Null.

I will update the appendix to reflect the text in section 4.2.

> to me that this is needed as part of the solution and should not be left

Should we reformulate here?

> 3. In Appendix I 4th paragraph " However, this does not apply if TBD TBD

The whole sentence will be removed.

> "MAY" and "SHOULD

Agreed.

---

From: "Roni Even (A)" <[email-masked]>
Date: Mon, 17 Jun 2019 13:25:49 +0000

Thanks,
The only comment left is:

I was expecting some recommendation since the changing of MAC address is important to address privacy issues (discussed in section 5). Currently it is left open with no recommendation , only saying that dynamic change of MAC address is needed.
Maybe the document should have some normative language for example in section 5.1 that will say that IP-OBU MUST dynamic change their MAC addresses

Did the document go through security area review?

Roni

From: Gen-art [mailto:[email-masked]] On Behalf Of NABIL BENAMAR
Sent: Monday, June 17, 2019 12:48 PM
To: Roni Even
Cc: [email-masked]; IETF Discussion; [email-masked]; [email-masked]
Subject: Re: [Gen-art] Genart last call review of draft-ietf-ipwave-ipv6-over-80211ocb-46

Dear Roni,

On Sun, Jun 16, 2019, 09:52 Roni Even via Datatracker <[email-masked]<mailto:[email-masked]>> wrote:
Reviewer: Roni Even
Review result: Almost Ready

Summary:

Major issues:

Minor issues:

.. What are the TBDs?

Nits/editorial comments:

Agreed.

---

From: Alexandre Petrescu <[email-masked]>
Date: Mon, 17 Jun 2019 16:11:54 +0200

I would like to ask for comparison to implementation too.

I dont want my implementation to become non-standard because it does not 
change its MAC address all the time.

Le 17/06/2019 à 15:25, Roni Even (A) a écrit :
> I was expecting some recommendation since the changing of MAC address is 
> important to address privacy issues (discussed in section 5). Currently 
> it is left open with no recommendation , only saying that dynamic change 
> of MAC address is needed.
> 
> Maybe the document should have some normative language for example in 
> section 5.1 that will say that IP-OBU MUST dynamic change their MAC 
> addresses
> 
> *From:*Gen-art [mailto:[email-masked]] *On Behalf Of *NABIL 
> BENAMAR
> *Sent:* Monday, June 17, 2019 12:48 PM
> *To:* Roni Even
> *Cc:* [email-masked]; IETF Discussion; [email-masked]; 
> [email-masked]
> *Subject:* Re: [Gen-art] Genart last call review of 
> draft-ietf-ipwave-ipv6-over-80211ocb-46
> 
> Dear Roni,
> 
> _______________________________________________
> its mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/its
>

---

From: NABIL BENAMAR <[email-masked]>
Date: Mon, 17 Jun 2019 18:37:44 +0100

Hi Roni,

I think we wrote this part some time ago...So what about the following:

"an example of change policy is to change the MAC address of the OCB
interface each time the system boots up"

On Mon, Jun 17, 2019 at 2:25 PM Roni Even (A) <[email-masked]> wrote:

> important to address privacy issues (discussed in section 5). Currently it
> is left open with no recommendation , only saying that dynamic change of
> MAC address is needed.
>
> *From:* Gen-art [mailto:[email-masked]] *On Behalf Of *NABIL
> BENAMAR

-- 

Best Regards

Nabil Benamar
Associate Professor
Department of Computer Sciences
School of Technology
Moulay Ismail University
Meknes. Morocco

---

From: "Roni Even (A)" <[email-masked]>
Date: Tue, 18 Jun 2019 08:40:38 +0000

Hi,
I am not a security expert, I was just trying to reflect that when reading the document I got the impression that privacy is a major concern since the IP-OBU is moving and its location can be traced by sniffing the MAC addresses.

Maybe it will be good to have a security review of the document. I also noticed that there is support in IEEE SA - 1609.4-2016 for MAC address change.

Roni Even

From: Dick Roy [mailto:[email-masked]]
Sent: Monday, June 17, 2019 10:48 PM
To: Roni Even (A); 'NABIL BENAMAR'; 'Roni Even'
Cc: [email-masked]; 'IETF Discussion'; [email-masked]; [email-masked]
Subject: RE: [ipwave] [Gen-art] Genart last call review of draft-ietf-ipwave-ipv6-over-80211ocb-46

________________________________
From: its [mailto:[email-masked]] On Behalf Of Roni Even (A)
Sent: Monday, June 17, 2019 6:26 AM
To: NABIL BENAMAR; Roni Even
Cc: [email-masked]<mailto:[email-masked]>; IETF Discussion; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [ipwave] [Gen-art] Genart last call review of draft-ietf-ipwave-ipv6-over-80211ocb-46

Thanks,

I was expecting some recommendation since the changing of MAC address is important to address privacy issues (discussed in section 5). Currently it is left open with no recommendation , only saying that dynamic change of MAC address is needed.
Maybe the document should have some normative language for example in section 5.1 that will say that IP-OBU MUST dynamic change their MAC addresses
[RR] I highly recommend AGAINST this!  There will be a number OBU and RSU implementations that DO NOT require anonymity, and don't want it either.  Furthermore, immutable identifier change must be coordinated with all other interfaces and protocols otherwise changing them is useless.

Did the document go through security area review?
[RR] If it did, and the above was not mentioned, then something was missed.

Roni

From: Gen-art [mailto:[email-masked]] On Behalf Of NABIL BENAMAR
Sent: Monday, June 17, 2019 12:48 PM
To: Roni Even
Cc: [email-masked]<mailto:[email-masked]>; IETF Discussion; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Gen-art] Genart last call review of draft-ietf-ipwave-ipv6-over-80211ocb-46

Dear Roni,

Summary:

Major issues:

Minor issues:

Nits/editorial comments:

Agreed.

---

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 18 Jun 2019 12:24:18 +0200

It is a good idea.  It would unlock an important issue in the IPWAVE WG.

Le 18/06/2019 à 11:26, Roni Even (A) a écrit :
> Hi, Maybe use similar language as in
> https://tools.ietf.org/id/draft-ietf-ipwave-vehicular-networking-09.txt
>
>  For the protection of drivers' privacy, the pseudonym of a MAC 
> address of a vehicle's network interface should be used, with the 
> help of which the MAC address can be changed periodically.

YEs, and use 'MAY' instead of 'should'.

> I only found the sentence " The policy dictating when the MAC address
> is  changed on the 802.11-OCB interface is to-be-determined" as too
> weak.

I agree, it begs for clarification.

Alex

> 
> 
> Roni
> 
> -----Original Message----- From: ietf [mailto:[email-masked]]
> On Behalf Of Alexandre Petrescu Sent: Tuesday, June 18, 2019 12:10
> PM To: [email-masked] Subject: Re: [ipwave] [Gen-art] Genart last call
> review of draft-ietf-ipwave-ipv6-over-80211ocb-46
> 
> Hi, I understand the text makes one think the way you do.
> 
> Privacy is indeed a major issue in vehicular networks.
> 
> I dont know how to better formulate this MAC address change such as
> to be ready for the future, and also be compatible with the present.
> 
> 1609.4 is not implemented in all places.  Those who implement 1609.4
> do not implement IPv6-over-OCB.  1609.4 implementations, such as all
> 1609 implementations, come with a high cost in software, hardware and
> necessary skillset.
> 
> IPv6-over-OCB comes at significantly lower cost in the three.
> 
> Alex
> 
> Le 18/06/2019 à 10:40, Roni Even (A) a écrit :
>> Hi,
>> 
>> I am not a security expert, I was just trying to reflect that when 
>> reading the document I got the impression that privacy is a major 
>> concern since the IP-OBU is moving and its location can be traced
>> by sniffing the MAC addresses.
>> 
>> Maybe it will be good to have a security review of the document. I 
>> also noticed that there is support in IEEE SA - 1609.4-2016 for
>> MAC address change.
>> 
>> Roni Even
>> 
>> *From:*Dick Roy [mailto:[email-masked]] *Sent:* Monday, June
>> 17, 2019 10:48 PM *To:* Roni Even (A); 'NABIL BENAMAR'; 'Roni
>> Even' *Cc:* [email-masked]; 'IETF Discussion'; [email-masked]; 
>> [email-masked] *Subject:* RE:
>> [ipwave] [Gen-art] Genart last call review of 
>> ----------------------------------------------------------------------
>>
>> 
--
>> 
>> *From:*its [mailto:[email-masked]] *On Behalf Of *Roni Even
>> (A) *Sent:* Monday, June 17, 2019 6:26 AM *To:* NABIL BENAMAR; Roni
>> Even *Cc:* [email-masked] <mailto:[email-masked]>; IETF
>> Discussion; [email-masked] <mailto:[email-masked]>; 
>> <mailto:[email-masked]> 
>> *Subject:* Re: [ipwave] [Gen-art] Genart last call review of 
>> 2. In section 5.2 "The policy dictating when the MAC address is 
>> changed on the 802.11-OCB interface is to-be-determined.". Reading
>> the next sentence it looks to me that this is needed as part of
>> the solution and should not be left for the unknown future.
>> 
>> I was expecting some recommendation since the changing of MAC
>> address is important to address privacy issues (discussed in
>> section 5). Currently it is left open with no recommendation , only
>> saying that dynamic change of MAC address is needed.
>> 
>> Maybe the document should have some normative language for example
>> in section 5.1 that will say that IP-OBU MUST dynamic change their
>> MAC addresses
>> 
>> */[RR] I highly recommend AGAINST this!  There will be a number
>> OBU and RSU implementations that DO NOT require anonymity, and
>> don't want it either.  Furthermore, immutable identifier change
>> must be coordinated with all other interfaces and protocols
>> otherwise changing them is useless./*
>> 
>> */[RR] If it did, and the above was not mentioned, then something
>> was missed./*
>> 
>> Roni
>> 
>> *From:*Gen-art [mailto:[email-masked]] *On Behalf Of
>> *NABIL BENAMAR *Sent:* Monday, June 17, 2019 12:48 PM *To:* Roni
>> Even *Cc:* [email-masked] <mailto:[email-masked]>; IETF
>> Discussion; [email-masked] <mailto:[email-masked]>; 
>> <mailto:[email-masked]> 
>> On Sun, Jun 16, 2019, 09:52 Roni Even via Datatracker 
>> <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Reviewer: Roni Even Review result: Almost Ready
>> 
>> I am the assigned Gen-ART reviewer for this draft. The General
>> Area Review Team (Gen-ART) reviews all IETF documents being
>> processed by the IESG for the IETF Chair.  Please treat these
>> comments just like any other last call comments.
>> 
>> Document: draft-ietf-ipwave-ipv6-over-80211ocb-?? Reviewer: Roni
>> Even Review Date: 2019-06-16 IETF LC End Date: 2019-06-26 IESG
>> Telechat date: Not scheduled for a telechat
>> 
>> Summary: The document is almost ready for publication as a standard
>> track RFC
>> 
>> Major issues:
>> 
>> Minor issues:
>> 
>> 1. Section 4.2  says "IP packets MUST be transmitted over
>> 802.11-OCB media as QoS Data" while appendix F say "The STA may
>> send data frames of subtype Data, Null, QoS Data, and QoS Null.
>> 
>> 2. In section 5.2 "The policy dictating when the MAC address is 
>> changed on the 802.11-OCB interface is to-be-determined.". Reading
>> the next sentence it looks to me that this is needed as part of the
>> solution and should not be left for the unknown future.
>> 
>> 3. In Appendix I 4th paragraph " However, this does not apply if
>> TBD TBD TBD. " ... What are the TBDs?
>> 
>> Nits/editorial comments: 1. In appendix I last paragraph "Support
>> of RFC 8505 is may be implemented on OCB." should be "Support of
>> RFC 8505 may be implemented on OCB." 2. In Appendix I "OCB nodes
>> that support RFC 8505 would support the 6LN operation in order to 
>> act as a host".  I think that instead of "would" it should be 
>> "should"  also if this is a recommendation why not have this
>> paragraph not in an appendix with "MAY" and "SHOULD
>> 
>> Agreed.
>> 
> 
>

---

From: NABIL BENAMAR <[email-masked]>
Date: Tue, 18 Jun 2019 13:05:19 +0100

Thank you Roni,

There was a privacy review of the draft and I think we have reflected all
concerns.

In MHO, the security review will be done as part of the process.

On Tue, Jun 18, 2019, 11:40 Roni Even (A) <[email-masked]> wrote:

> Hi,
>
> I am not a security expert, I was just trying to reflect that when reading
> the document I got the impression that privacy is a major concern since the
> IP-OBU is moving and its location can be traced by sniffing the MAC
> addresses.
>
> *From:* Dick Roy [mailto:[email-masked]]
> *Sent:* Monday, June 17, 2019 10:48 PM
> *To:* Roni Even (A); 'NABIL BENAMAR'; 'Roni Even'
> *Cc:* [email-masked]; 'IETF Discussion'; [email-masked];
> *Subject:* RE: [ipwave] [Gen-art] Genart last call review of
> ------------------------------
>
> *From:* its [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Roni Even (A)
> *Sent:* Monday, June 17, 2019 6:26 AM
> *To:* NABIL BENAMAR; Roni Even
> *[RR] I highly recommend AGAINST this!  There will be a number OBU and RSU
> implementations that DO NOT require anonymity, and don’t want it either.
> Furthermore, immutable identifier change must be coordinated with all other
> interfaces and protocols otherwise changing them is useless.*
>
>
>
> *[RR] If it did, and the above was not mentioned, then something was
> missed.*
>
>
>
> Roni
>
>
>
>
>
> *From:* Gen-art [mailto:[email-masked]
> <[email-masked]>] *On Behalf Of *NABIL BENAMAR

---

From: "Roni Even (A)" <[email-masked]>
Date: Sun, 23 Jun 2019 06:18:08 +0000

Inline

________________________________
From: Roni Even (A) [mailto:[email-masked]]
Sent: Tuesday, June 18, 2019 1:41 AM
To: [email-masked]<mailto:[email-masked]>; 'NABIL BENAMAR'; 'Roni Even'
Cc: [email-masked]<mailto:[email-masked]>; 'IETF Discussion'; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: RE: [ipwave] [Gen-art] Genart last call review of draft-ietf-ipwave-ipv6-over-80211ocb-46

Hi,
I am not a security expert, I was just trying to reflect that when reading the document I got the impression that privacy is a major concern since the IP-OBU is moving and its location can be traced by sniffing the MAC addresses.
[RR] FYI ... there is no such thing as an IP-OBU unless this group chooses to define one.  I highly recommend against it for a variety of reasons including adding a network protocol identifier in front of a device identifier makes no sense.

[RE] IP-OBU is defined in section 2 and is used in 5.1 when discussing privacy

[RR] Yes, but it does NOT make such changes mandatory!   I made sure of that for the same reasons stated below.

Roni Even

Cc: [email-masked]<mailto:[email-masked]>; 'IETF Discussion'; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

Thanks,

Roni

Dear Roni,

Summary:

Major issues:

Minor issues:

Nits/editorial comments:

Agreed.

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 24 Jun 2019 08:35:34 +1200

Because of the non-plain text and the commenting styles used, I am
unclear who wrote what below, but please see my comment in line:
> Inline

The draft says, in section 5:

   For this reason, in the 802.11-OCB
   deployments, there is a strong necessity to use protection tools such
   as dynamically changing MAC addresses Section 5.2, semantically
   opaque Interface Identifiers and stable Interface Identifiers
   Section 4.4.  This may help mitigate privacy risks to a certain
   level.

I'm not quite sure how "strong necessity" relates to RFC2119 terminology,
but the current text seems to say that changing MAC addresses is at
least RECOMMENDED.

Also the quoted text is very hard to parse. Does "semantically opaque"
qualify "Interface Identifiers" or "Interface Identifiers and stable
"Interface Identifiers"? And how do stable Interface Identifiers help
to protect privacy?

(FYI, the data tracker does show that a SECDIR review has been requested.)

Regards
    Brian Carpenter

> ... What are the TBDs?
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art
>