Re: Getting started on NSIS extensibilty draft
"Hannes Tschofenig" <[email protected]>
| Newsgroups | gmane.ietf.nsis |
|---|---|
| Message-ID | <[email protected]> |
Hi Elwyn,
Thanks for the draft update.
The changes look good to me. Only a minor comment:
7. Security Features
Basic security functions are provided at the GIST layer, e.g.,
protection against some blind or denial-of-service attacks.
These security features are available with the the path-coupled MRM in the
GIST specification.
Other MRMs might provide different security features.
Conceptually it is difficult to protect against on-path attacker and
man-in-the-middle attacks, because a basic functionality of GIST is
to discover yet unknown signaling peers.
This is also only true for the path-coupled MRM.
While GIST is handling authentication of peer nodes, more fine
... and basic authorization
grained authentication may be required in the NSLP protocols.
s/authentication/authorization
There
is currently an ongoing work to specify common authorization
mechanisms to be used in NSLP protocols [I-D.manner-nsis-nslp-auth],
thus allowing, e.g., per-user and per-service authorization.
Ciao
Hannes
>-----Original Message-----
>From: [email protected] [mailto:[email protected]] On
>Behalf Of Elwyn Davies
>Sent: 04 March, 2009 02:55
>To: Martin Stiemerling
>Cc: [email protected]
>Subject: Re: [NSIS] Getting started on NSIS extensibilty draft
>
>I am working on this and should have a new version out tomorrow.
>
>It appears to me that interception classes could benefit from
>an IANA registry since they need to be common across multiple
>imstantiations, although it is not strictly necessary as they
>never appear on the wire and are only used to communicate
>acros the API to GIST locally in each router. I guess we can
>do without but it might be good to ad a sentence to GIST to
>the effect that a registry is not needed.
>
>/Elwym
>
>Martin Stiemerling wrote:
>> Hi,
>>
>> We need especially fulfil the dependency of the GIST draft
>mentioned in Section 5.3.2.5. Q-Mode Interception
>Extensibility of GIST.
>>
>> The text there says:
>> Guidelines on defining interception classes are given in [13].
>>
>> Where [13] is the extensibility document.
>>
>> Martin
>>
>> [email protected]
>>
>> NEC Laboratories Europe - Network Research Division NEC
>Europe Limited
>> | Registered Office: NEC House, 1 Victoria Road, London W3 6BL |
>> Registered in England 2832014
>>
>>
>>> -----Original Message-----
>>> From: [email protected] [mailto:[email protected]]
>On Behalf
>>> Of Jukka MJ Manner
>>> Sent: Friday, February 20, 2009 1:02 PM
>>> To: NSIS Working Group
>>> Subject: Re: [NSIS] Getting started on NSIS extensibilty draft
>>>
>>>
>>> Dear all,
>>>
>>> We would really need feedback to this draft to finalize it. I would
>>> like to issue a WGLC very soon, thus, one round of comments
>would be
>>> good to have before that.
>>>
>>> Alternatively, we can also issue a WGLC now, and discuss
>the comments
>>> in SF. Still, I'd rather see one round of comments before a WGLC.
>>>
>>> Regards,
>>> Jukka
>>>
>>> On Wed, 4 Feb 2009, Elwyn Davies wrote:
>>>
>>>
>>>> Hi, Magnus.
>>>>
>>>> At the last IETF you offered to provide me some guidance
>on the way
>>>> forward with this document.
>>>>
>>>> Since as I understand it, the IESG wants to see this
>document at the
>>>> same time as GIST this is urgent.
>>>>
>>>> The only suggestion I have stemming from comments at the meeting is
>>>>
>>> to
>>>
>>>> 'separate the rules and guidelines.'
>>>>
>>>> Any input gratefully received.
>>>> In the meantime I will try to make a 'null' update just to change
>>>> the title.
>>>>
>>>> Regards,
>>>> Elwyn
>>>>
>>>> Martin Stiemerling wrote:
>>>>
>>>>> The new file name should basically read this way (copy'n'paste
>>>>>
>>> error):
>>>
>>>>> draft-ietf-nsis-ext-00.txt.
>>>>>
>>>>> Thanks to Hannes for pointing this
>>>>>
>>>>> Martin
>>>>>
>>>>> [email protected]
>>>>>
>>>>> NEC Laboratories Europe - Network Research Division NEC Europe
>>>>> Limited | Registered Office: NEC House, 1 Victoria Road,
>>>>>
>>> London W3 6BL | Registered in England 2832014
>>>
>>>>>
>>>>>> -----Original Message-----
>>>>>> From: [email protected] [mailto:[email protected]] On
>>>>>>
>>> Behalf Of
>>>
>>>>>> Martin Stiemerling
>>>>>> Sent: Monday, January 26, 2009 3:05 PM
>>>>>> To: [email protected]
>>>>>> Subject: [NSIS] Getting started on NSIS extensibilty draft
>>>>>>
>>>>>> Dear all,
>>>>>>
>>>>>> We have a draft to be completed urgently :)
>>>>>>
>>>>>> Using and Extending the NSIS Protocol Family
>draft-nsis-ext-02.txt
>>>>>>
>>>>>> http://tools.ietf.org/html/draft-nsis-ext-02
>>>>>>
>>>>>>
>>>>>> First thing to do is changing the file name to draft-ietf-nsis-
>>>>>>
>>> ext-
>>>
>>>>>> 02.txt.
>>>>>>
>>>>>> Please review it and send your comments.
>>>>>>
>>>>>> Martin
>>>>>>
>>>>>>
>>>>>> [email protected]
>>>>>>
>>>>>> NEC Laboratories Europe - Network Research Division NEC Europe
>>>>>> Limited | Registered Office: NEC House, 1 Victoria
>>>>>>
>>> Road,
>>>
>>>>>> London W3 6BL | Registered in England 2832014
>>>>>>
>>>>>> _______________________________________________
>>>>>> nsis mailing list
>>>>>> [email protected]
>>>>>> https://www.ietf.org/mailman/listinfo/nsis
>>>>>>
>>>>>>
>>>>> _______________________________________________
>>>>> nsis mailing list
>>>>> [email protected]
>>>>> https://www.ietf.org/mailman/listinfo/nsis
>>>>>
>>>>>
>>>>>
>>>> _______________________________________________
>>>> nsis mailing list
>>>> [email protected]
>>>> https://www.ietf.org/mailman/listinfo/nsis
>>>>
>>>>
>>> _______________________________________________
>>> nsis mailing list
>>> [email protected]
>>> https://www.ietf.org/mailman/listinfo/nsis
>>>
>> _______________________________________________
>> nsis mailing list
>> [email protected]
>> https://www.ietf.org/mailman/listinfo/nsis
>>
>>
>_______________________________________________
>nsis mailing list
>[email protected]
>https://www.ietf.org/mailman/listinfo/nsis
>