Subject: [sfc] TR: New Version Notification for draft-rebo-sfc-nsh-integrity-02.txt

From: <[email-masked]>
Date: Wed, 20 Nov 2019 10:39:53 +0000

Hi all, 

I'm pleased to share this updated version of this spec. This version integrates a detailed review and inputs from Dan. 

FWIW, the main changes are as follows:
* SFFs are not supplied by design with the encryption material
* Motivate why base and service headers are not encrypted
* The inner packet is also integrity protected
* Use of timestamp to protect against replay attacks
* Restructure the design overview section to better highlight the provided security protection services, which elements are involved, etc.
* Add a new section to discuss key management considerations
* Add a new section to discuss NSH-in-NSH
* Add more details to the processing rules 
* And many edits. 

Comments, question, and suggestions are more than welcome. 

Cheers,
Med

> -----Message d'origine-----
> De : [email-masked] [mailto:[email-masked]]
> Envoyé : mercredi 20 novembre 2019 11:27
> À : Dan Wing; Tirumaleswar Reddy; Tirumaleswar Reddy.K; BOUCADAIR Mohamed
> TGI/OLN
> Objet : New Version Notification for draft-rebo-sfc-nsh-integrity-02.txt
> 
> 
> A new version of I-D, draft-rebo-sfc-nsh-integrity-02.txt
> has been successfully submitted by Mohamed Boucadair and posted to the
> IETF repository.
> 
> Name:		draft-rebo-sfc-nsh-integrity
> Revision:	02
> Title:		Integrity Protection for
>     Network Service Header (NSH) and Encryption of Sensitive Context
>     Headers
> Document date:	2019-11-20
> Group:		Individual Submission
> Pages:		26
> URL:            https://www.ietf.org/internet-drafts/draft-rebo-sfc-nsh-
> integrity-02.txt
> Status:         https://datatracker.ietf.org/doc/draft-rebo-sfc-nsh-
> integrity/
> Htmlized:       https://tools.ietf.org/html/draft-rebo-sfc-nsh-integrity-02
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-rebo-sfc-nsh-
> integrity
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-rebo-sfc-nsh-
> integrity-02
> 
> Abstract:
>    This specification adds integrity protection and optional encryption
>    of sensitive metadata directly to Network Service Headers (NSH) used
>    for Service Function Chaining (SFC).
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat

---

From: Tal Mizrahi <[email-masked]>
Date: Thu, 28 Nov 2019 16:23:36 +0200

Hi,

A comment regarding the Timestamp format that is defined in Section 5.2.
The Timestamp format should be defined carefully. Please take a look at
"Guidelines for Defining Packet Timestamps"
(draft-ietf-ntp-packet-timestamps).
I recommend to use the template - Section 3 of
draft-ietf-ntp-packet-timestamps. The examples in the draft are pretty
helpful.

Cheers,
Tal.

On Wed, Nov 20, 2019 at 12:40 PM <[email-masked]> wrote:

> Hi all,
>
> I'm pleased to share this updated version of this spec. This version
> integrates a detailed review and inputs from Dan.
>
> * Restructure the design overview section to better highlight the provided
> security protection services, which elements are involved, etc.
> > Htmlized:
> https://tools.ietf.org/html/draft-rebo-sfc-nsh-integrity-02
> > Htmlized:
> https://datatracker.ietf.org/doc/html/draft-rebo-sfc-nsh-
> > integrity
> _______________________________________________
> sfc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sfc
>