Subject: [tcpm] Looking for advice on a draft from the PCE working group

From: "Diego R. Lopez" <[email-masked]>
Date: Tue, 11 Mar 2014 12:18:49 +0000

Hi,

There is a draft, recently adopted by the PCE WG, on running the PCEP protocol on top of TLS. During the discussion of this draft several issues regarding transport aspects were raised, essentially dealing with the usage of TCP security options and with the need for requiring a separate port from the "plain" PCEP. The WG decided to seek for advice from the transport community and the ADs pointed me to this list as the most appropriate place for such an advice.

You have the text of the draft available through https://datatracker.ietf.org/doc/draft-ietf-pce-pceps/

Any feedback on the above mentioned issues or anything else you see in the document will be extremely welcome.

Be goode,
--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------

________________________________

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at:
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

---

From: Joe Touch <[email-masked]>
Date: Tue, 11 Mar 2014 15:43:24 -0700

Some comments:

- the title should be changed to focus on TLS; the term "transport 
security" means different things to different people.

- Contrary to the claim in the Introductino, RFC5440 makes very specific 
requirements on PCEP, e.g., it MUST use TCP MD5

this document appears to override that requirement with TCP-AO; while I 
support that, the change needs to be more explicit

- I disagree with the need for (yet another) port for a TLS-enabled 
PCEP; STARTTLS allows the use of TLS to be negotiated in-band, and so 
the existing port should be used

Joe

On 3/11/2014 5:18 AM, Diego R. Lopez wrote:
> _______________________________________________
> tcpm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tcpm
>

---

From: Qin Wu <[email-masked]>
Date: Thu, 13 Mar 2014 10:35:01 +0000

Hi, Joe:
It is still not clear to me when we choose the same port and when we choose the different port if we apply TLS to different protocols,
Take SMTP, POP3,IMAP as examples:
Protocol

Purpose

Normal port

SSL variant

SSL port

SMTP<http://en.wikipedia.org/wiki/SMTP>

Send email

25/587

SMTPS<http://en.wikipedia.org/wiki/SMTPS>

465[5]<http://en.wikipedia.org/wiki/STARTTLS#cite_note-5>

POP3<http://en.wikipedia.org/wiki/POP3>

Retrieve email

110

POP3S<http://en.wikipedia.org/w/index.php?title=POP3S&action=edit&redlink=1>

995

IMAP<http://en.wikipedia.org/wiki/IMAP>

Read email

143

IMAPS<http://en.wikipedia.org/wiki/IMAPS>

993

It looks to me when we apply SSL to SMTP,POP3,IMAP, then SMTP, POP3 and IMAP with SSL support(i.e.,SMTPS,POP3S,IMAPS)

Will usually choose the different ports.

The same rule above is also applied to HTTP when we apply SSL to HTTP(i.e., HTTPS).

Regards!

-Qin

-----Original Message-----
From: Joe Touch [mailto:[email-masked]]
Sent: Wednesday, March 12, 2014 6:43 AM
To: Diego R. Lopez; [email-masked]
Cc: [email-masked]
Subject: Re: [tcpm] Looking for advice on a draft from the PCE working group

Some comments:

Joe

---

From: Gorry Fairhurst <[email-masked]>
Date: Thu, 13 Mar 2014 15:10:50 +0000

Some of these started off as insecure protocols where security was a 
later addition. This draft may help (it's about to be WGLC'ed in the 
Transport Area WG):

http://tools.ietf.org/html/draft-ietf-tsvwg-port-use-03

Gorry

---

From: Joe Touch <[email-masked]>
Date: Thu, 13 Mar 2014 08:57:36 -0700

Hi, Qin,

On 3/13/2014 3:35 AM, Qin Wu wrote:
> Hi, Joe:
>
> It is still not clear to me when we choose the same port and when we
> choose the different port if we apply TLS to different protocols,

It's simple to determine:

	- if you designed your service before STARTTLS, then you needed
	a separate port

	- if you are designing your port now, you don't

> Take SMTP, POP3,IMAP as examples:
...
> It looks to me when we apply SSL to SMTP,POP3,IMAP, then SMTP, POP3 and
> IMAP with SSL support(i.e.,SMTPS,POP3S,IMAPS)
>

All of the above are good examples of the first part of the rule.

Note that we have other assignments that now would be declined, because 
we've learned to do better. E.g., there would not be a POP2 or POP3 
because we would expect POP to indicate the protocol version in-band. We 
also no longer assign multiple names for the same service, as was done 
for http/www, nor do we now assign multiple ports for the same service 
(80, 8080), nor do we now assign ports for development purposes  (http-dev).

We've learned to do better.

Joe