BPSEC Updates Edward Birrane Edward.Birrane@jhuapl.edu 443-778-7423

Overview Updates Additions TODO No significant issues or limitations defined to date with BPSec. Updates Editorial cleanup, particularly around multi-target blocks Moved to standards-track document Additions Added guidance on defining other security blocks (OSBs) TODO Updates as needed to track any impactful changes from Bpbis In particular, defer to CBOR encoding for BPbis. Updates references in security and policy considerations areas to include some additional IETF references.

Guidance on OSBs (1/2) MUST support unique identifies. Cannot re-use or override BPSec type codes, etc. MUST address how the OSB interacts with BPSec blocks. Can the OSB be the target of a BIB and/or a BCB? Can the OSB itself target BIBs and BCBs? MUST provide a canonicalization algorithm IF the OSB can be the target of a BIB or BCB May simply default to the standard extension block algorithm already supplied with BPSec. If supplied, a canonicalization algorithm must always be used.

Guidance on OSBs (2/2) MUST retain a deterministic processing order compatible with the BPSec processing order. An implementation receving a bundle containing BIBs, BCB, and the OSB should always process blocks Must not require behavior in conflict with BPSec. In particular with regard to security processing requirements. Must address fragmentation How to process bundles representing fragments. How to handle an OSB in a bundle that may no longer, due to fragmentation, contain its security target. Whether an OSB can be added to a bundle that is flagged as being a fragment.

TODO Planned changes: Open Questions (from last IETF) No more major planned changes. Some items identified already: MUST used instead of must in 2 places Section 3.7 needs to identify minimum parameter set and change wording to not apply to fragments. Remove Section 10 “Conformance” Will likely review encoding and security/policy considerations sections as we process feedback. Open Questions (from last IETF) Should BPSec provide an encoding? (NO. BP will do that) If yes, should the encoding be optional or mandatory? Does BPSec really need blocks transmitted in order? (NO) 5

What next? Currently have 3 expired drafts that need to be considered Security Best Practices https://tools.ietf.org/html/draft-birrane-dtn-sec-practices-00 Expired July 1st, 2016 Suite-B Profile for BPSec https://tools.ietf.org/html/draft-birrane-dtn-bpsec-suiteb-profile-00 Expired July 3rd, 2016 Suite-B Ciphersuites for BPSec https://tools.ietf.org/html/draft-birrane-dtn-bpsec-suiteb-ciphersuites-00 6

Thank you! Questions? 7