Subject: Re: [saag] Review request: SFC/NSH Integrity (draft-rebo-sfc-nsh-integrity)

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 6 Feb 2020 18:32:59 -0800

Hi Med,

This topic reminds me a bit about draft-ietf-6man-segment-routing-header,
where I had a fairly extensive discussion with the authors about what
security properties were actually provided by their HMAC TLV.
This document (from a very quick skim) looks to be going further and
providing confidentiality mechanisms as well, which could be interesting.

-Ben

On Fri, Jan 31, 2020 at 10:28:29AM +0000, [email-masked] wrote:
> Hi all, 
> 
> Daniel kindly suggested we share this draft on saag for review. Hence, this note to the list. 
> 
> The draft specifies how integrity protection can be added to NSH (RFC8300); the document allows also for encrypting privacy-sensitive NSH TLVs. FWIW, Service Function Chaining (SFC) reference architecture can be found at RFC7565.
> 
> Comments and suggestions are more than welcome.
> 
> Cheers,
> Med
> 
> -----Message d'origine-----
> De : [email-masked] [mailto:[email-masked]] 
> Envoyé : vendredi 31 janvier 2020 11:03
> À : Dan Wing; Tirumaleswar Reddy; Tirumaleswar Reddy.K; BOUCADAIR Mohamed TGI/OLN
> Objet : New Version Notification for draft-rebo-sfc-nsh-integrity-03.txt
> 
> 
> A new version of I-D, draft-rebo-sfc-nsh-integrity-03.txt
> has been successfully submitted by Mohamed Boucadair and posted to the
> IETF repository.
> 
> Name:		draft-rebo-sfc-nsh-integrity
> Revision:	03
> Title:		Integrity Protection for Network Service Header (NSH) and Encryption of Sensitive Context Headers
> Document date:	2020-01-31
> Group:		Individual Submission
> Pages:		28
> URL:            https://www.ietf.org/internet-drafts/draft-rebo-sfc-nsh-integrity-03.txt
> Status:         https://datatracker.ietf.org/doc/draft-rebo-sfc-nsh-integrity/
> Htmlized:       https://tools.ietf.org/html/draft-rebo-sfc-nsh-integrity-03
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-rebo-sfc-nsh-integrity
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-rebo-sfc-nsh-integrity-03
> 
> Abstract:
>    This specification adds integrity protection and optional encryption
>    of sensitive metadata directly to Network Service Headers (NSH) used
>    for Service Function Chaining (SFC).
> 
>                                                                                   
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
> 
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Fri, 21 Feb 2020 12:13:20 +0000

Hi Ben,

Please see inline 

> -----Original Message-----
> From: Benjamin Kaduk <[email-masked]>
> Sent: Friday, February 7, 2020 8:03 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Re: [saag] Review request: SFC/NSH Integrity (draft-rebo-sfc-nsh-
> integrity)
> 
> CAUTION: External email. Do not click links or open attachments unless you
> recognize the sender and know the content is safe.
> 
> Hi Med,
> 

The challenge is not all the SFC data plane elements need to act on the privacy-sensitive metadata. The draft is currently using AES_128_CBC_HMAC_SHA_256 and the keying material (ENC_KEY and MAC_KEY) is handed to service functions authorized to act on the privacy-sensitive metadata and update the service path header. MAC_KEY is only handed to service functions and SFFs not authorized to act on the privacy-sensitive metadata.  We would like to use AES-GCM and HMAC but that introduces two authentication tags (one explicit and the other implicit) and the additional 128-bit authentication tag may not be acceptable for NSH data for every packet. 

Cheers,
-Tiru

> > The draft specifies how integrity protection can be added to NSH (RFC8300);
> the document allows also for encrypting privacy-sensitive NSH TLVs. FWIW,
> Service Function Chaining (SFC) reference architecture can be found at
> RFC7565.
> >
> > De : [email-masked] [mailto:[email-masked]] Envoyé
> > : vendredi 31 janvier 2020 11:03 À : Dan Wing; Tirumaleswar Reddy;
> > Tirumaleswar Reddy.K; BOUCADAIR Mohamed TGI/OLN Objet : New
> Version
> > Notification for draft-rebo-sfc-nsh-integrity-03.txt
> >
> >
> > Please note that it may take a couple of minutes from the time of
> > submission until the htmlized version and diff are available at tools.ietf.org.
> >
> > The IETF Secretariat
> >