Re: AD review of draft-ietf-shim6-proto -- sections 6 through 7.17

[marcelo bagnulo braun <marcelo@it.uc3m.es>]

Hi Jari,


El 12/09/2007, a las 16:59, Jari Arkko escribió:

> Continuing with the review:
>
> Substantial:
>
> >    o  For each peer locator, a flag whether it has been verified  
> > using
> >       HBA or CGA, and a bit whether the locator has been probed to
> >       verify that the ULID is present at that location.
>
> Is there a need to remember *when* such probing has last
> happened? If not, why not?

My view on this one is:

There are two perspectives for this test: the security perspective  
and the reachability perspective.

This document only deals with the security perspective, while the  
reachability perspective is detailed in the failure detection  
document. For the reachability perspective, this info and other info  
may be needed, but this is not covered by this document, since the  
failure detection document describes this part in detail.

From the security perspective, this is covered in this document, and  
i don't think the time information is needed. I mean, if the test has  
been successful once, then you have a sufficient protection against  
flooding attacks imho (we do not need to protect against time shifted  
flooding attacks imho)
Please note that section 7.2. locator verification reccommends that  
the reachability verification is performed just before the locator is  
to be used, which seems to me the appropriate time to do this.

So, to proceed i would ask:

do you think we need to include additional information that is used  
for reachability status or is it ok that this is not covered by this  
document and covered by the failure detection document?
do you agree that the proper level of security is achieved without  
keeping track about when the test was performed or do you think this  
info is needed?

> >    o  The preferred peer locator - used as destination; Lp(peer)
>
> First, this sentence was hard to parse. Second, preferred != the
> one we are using as a destination. Please explain or
> modify. Did you mean the current locator that we are using?

yes, the preferred peer locator is the one we are using as destination

> The failure-detection draft uses the term "current address
> pair", so it would be good to align with that.

ok, i have changed it to current peer locator

and i have rephrased it to make it clearer as:


   o  The current peer locator, is the locator used as destination  
address when sending packets; Lp(peer)

similarly to the source one:

   o  The current local locator, is the locator used as source  
address when sending packets; Lp(local)


regards, marcelo


> I'm reading
> on...
>
> >    o  The preferred local locator - used as source; Lp(local)
>
> As above.
>
> Jari