1. BPSEC Updates
Edward Birrane

2. Overview Updates Additions TODO
No significant issues or limitations defined to date with BPSec.
Updates
Editorial cleanup, particularly around multi-target blocks
Moved to standards-track document
Additions
Added guidance on defining other security blocks (OSBs)
TODO
Updates as needed to track any impactful changes from Bpbis
In particular, defer to CBOR encoding for BPbis.
Updates references in security and policy considerations areas to include some additional IETF references.

3. Guidance on OSBs (1/2) MUST support unique identifies.
Cannot re-use or override BPSec type codes, etc.
MUST address how the OSB interacts with BPSec blocks.
Can the OSB be the target of a BIB and/or a BCB?
Can the OSB itself target BIBs and BCBs?
MUST provide a canonicalization algorithm IF the OSB can be the target of a BIB or BCB
May simply default to the standard extension block algorithm already supplied with BPSec.
If supplied, a canonicalization algorithm must always be used.

4. Guidance on OSBs (2/2)
MUST retain a deterministic processing order compatible with the BPSec processing order.
An implementation receving a bundle containing BIBs, BCB, and the OSB should always process blocks
Must not require behavior in conflict with BPSec.
In particular with regard to security processing requirements.
Must address fragmentation
How to process bundles representing fragments.
How to handle an OSB in a bundle that may no longer, due to fragmentation, contain its security target.
Whether an OSB can be added to a bundle that is flagged as being a fragment.

5. TODO Planned changes: Open Questions (from last IETF)
No more major planned changes. Some items identified already:
MUST used instead of must in 2 places
Section 3.7 needs to identify minimum parameter set and change wording to not apply to fragments.
Remove Section 10 “Conformance”
Will likely review encoding and security/policy considerations sections as we process feedback.
Open Questions (from last IETF)
Should BPSec provide an encoding? (NO. BP will do that)
If yes, should the encoding be optional or mandatory?
Does BPSec really need blocks transmitted in order? (NO) 5

6. What next? Currently have 3 expired drafts that need to be considered
Security Best Practices
Expired July 1st, 2016
Suite-B Profile for BPSec
Expired July 3rd, 2016
Suite-B Ciphersuites for BPSec 6

7. Thank you!
Questions? 7