<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Re:<o:p></o:p></p><p class=MsoNormal><span style='color:black'>comments dealt with things like “how do I know the source EID of this bundle isn’t spoofed”? I think the way we’ve thought of to address that is BPsec, so there’s a little bit of text there about BPsec and network management. </span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>A minor clarification:<o:p></o:p></p><p class=MsoNormal>BPSec provides an integrity value which can be a keyed integrity i.e., an HMAC. An HMAC provides authentication, but it does not provide non-repudiation.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For BPSec to provide non-repudiation the “integrity” or bib must use an approved digital signature algorithm (i.e., ECDSA P384). I haven’t been able to view the posted document, but it should state that when BPSec bib utilizes an approved digital signature algorithm then it can provide non-repudiation (i.e., <span style='color:black'>how do I know the source EID of this bundle isn’t spoofed).<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>mA</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:12.0pt;color:black'>From: </span></b><span style='font-size:12.0pt;color:black'>SIS-DTN <sis-dtn-bounces@mailman.ccsds.org> on behalf of "sburleig.sb--- via SIS-DTN" <sis-dtn@mailman.ccsds.org><br><b>Reply-To: </b><sburleig.sb@gmail.com><br><b>Date: </b>Friday, October 7, 2022 at 11:18 AM<br><b>To: </b>"'Dr. Keith L Scott'" <kscott@mitre.org>, <sis-dtn@mailman.ccsds.org><br><b>Subject: </b>Re: [Sis-dtn] BPv7 PIDS<o:p></o:p></span></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>I look forward to thinking about all this stuff in more detail next week. Meanwhile, on 2b) below, let me just observe that we’ve had a working implementation of delay-tolerant key administration in ION for several years.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Scott<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> SIS-DTN <sis-dtn-bounces@mailman.ccsds.org> <b>On Behalf Of </b>Dr. Keith L Scott via SIS-DTN<br><b>Sent:</b> Friday, October 7, 2022 10:59 AM<br><b>To:</b> sis-dtn@mailman.ccsds.org<br><b>Subject:</b> [Sis-dtn] BPv7 PIDS<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>OK, I’ve uploaded all the PIDs to the “CESG Review 1 20221000” folder. There are the RID-formatted ones from SLS and the document markup from Peter (in the .docx document). In the document I inserted Peter’s comments as comments and replied to most of them. I think there are a couple large topics listed below (though I invite folks to correct that assessment). As a way to address some of these I added some text to the end of section 2 talking about ongoing / future work; many of Peter’s comments dealt with things like “how do I know the source EID of this bundle isn’t spoofed”? I think the way we’ve thought of to address that is BPsec, so there’s a little bit of text there about BPsec and network management. Have a look, comment at will.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Larger topics for discussion:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>1) What information needs to be in a node / EID registry? e.g. should it contain information about the convergence layers a node supports or other (detailed) configuration information? What if those convergence layers / the configuration information vary with time?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Options for information here include:<o:p></o:p></p><p class=MsoNormal>Node Number<o:p></o:p></p><p class=MsoNormal>POC<o:p></o:p></p><p class=MsoNormal>Mission<o:p></o:p></p><p class=MsoNormal>Bundle Protocol versions supported<o:p></o:p></p><p class=MsoNormal>Physical asset to which this node is tied / on which the node is hosted<o:p></o:p></p><p class=MsoNormal>Maximum supported bundle size<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>EID naming schemes supported<o:p></o:p></p><p class=MsoNormal>List of extension block types supported<o:p></o:p></p><p class=MsoNormal>Does the node support BPsec?<o:p></o:p></p><p class=MsoNormal>Does the node implement standardized network management?<o:p></o:p></p><p class=MsoNormal>If implements standardized network management, which ADMs?<o:p></o:p></p><p class=MsoNormal>Lit of Convergence Layer Adaptors supported<o:p></o:p></p><p class=MsoNormal>The number of kilobytes of storage allocated to bundle retention at this node and not currently occupied by bundles.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>---- <I think the following are 'too much' for the 'node number' registry -- Maybe we define some sort of separate 'ops' registry for highly-dynamic information?> ------<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>CL addresses / names (e.g. DNS name to resolve to an IP address)<o:p></o:p></p><p class=MsoNormal>Schedule for when communications are supported (contact plan)<o:p></o:p></p><p class=MsoNormal>Security key information (to support identity)<o:p></o:p></p><p class=MsoNormal>Services supported by this node (e.g. bping, cfdp, ...)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>2b) For the moment, until we (SIS-DTN and SEA-SEC) work out something better, the key management solution (both for configuring keys / key management and exchanging keymat so as to identify peers) is going to be 'manual'.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>3) It might be worth adding a subsection to the end of section 2 that discusses ongoing / future work. Such a subsection could talk about BPsec and a bit about how we envision its use to support authentication / identity, and network management including the types of information we expect to be managed by some of the basic ADMs.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>How MUCH do we need to discuss security (and potential security policies) there? We have a BPsec Red Book and a Green Book in the current charter.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> --keith<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>_______________________________________________ SIS-DTN mailing list SIS-DTN@mailman.ccsds.org https://mailman.ccsds.org/cgi-bin/mailman/listinfo/sis-dtn <o:p></o:p></p></div></body></html>