Re: [dtn] [EXTERNAL] BPbis consensus status

[Marc Blanchet <[e-mail]>]

On 18 Sep 2020, at 10:03, Magnus Westerlund wrote:

> Hi,
>
> Personal opinions below.
>
> Marc, I think comparing BPSec with IP and IPsec is wrong for several 
> reasons. I
> think one of the more significant ones are related to the 
> identification of the
> peer entitity and who you are and establishing security between these 
> two
> entities end-to-end. IPSec is to low level for that to work in the 
> Internet as
> endpoint or possibly whole networks (due to NATs) exist under the 
> umbrella of an
> IP address. However, I don't see that being the case for BP. Here BP 
> can address
> the applicaiton specifically and create security association 
> end-to-end between
> the application entities on different nodes. Becasue the BP agent can 
> provide
> unique DTN addresses for each application and establish different 
> BPSec security
> contexts to prevent this missmatch. So BPSec has all the chance of 
> being the
> basic security layer end-to-end that IPsec never succed as.

well, I personally disagree and still stand. However, as I wrote some 
emails ago, it seems that I’m the only one in this email list on that 
side, so I’m loosing and it is fine. We shall just proceed with the 
concensus of the group. No issues for me to proceed the way the group 
wants

Regards, Marc.

>
> Yes, there are hurdle to get the details for security contexts 
> (security
> profile) and its key-management done. But without this I don't see how 
> DTN will
> even become more that narrow nichese where it is used ontop of a 
> private
> network. There are some utility in that, but far from the promise of 
> the network
> and networks for delay tolerant applications that could use a 
> interwork layer. I
> think BP can succeed, but not without a security solution that work 
> and are
> generally available and supported.
>
> Cheers
>
> Magnus
>
>
>
>
> On Thu, 2020-09-17 at 18:46 -0400, R. Atkinson wrote:
>>> On Sep 16, 2020, at 23:25, Marc Blanchet <[e-mail]> 
>>> wrote:
>>> ... as current Internet deployment tells us, the applications need 
>>> to be
>>> aware
>>> of security services ...
>>
>> Marc,
>>
>> Your words above - to the extent they are true — are a reason
>> to have a well documented BPsec API which applications can use
>> if/when appropriate.
>>
>> Such an API probably should be documented in an Informational RFC.
>> Is that something you might want to undertake — since you are so
>> passionate about it ??
>>
>> From a logic perspective, those words quoted above are really NOT a 
>> reason
>> for  BPsec to be optional to implement.
>>
>> Yours,
>>
>> Ran
>>
>> _______________________________________________
>> dtn mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/dtn
> -- 
> Cheers
>
> Magnus Westerlund
>
>
> ----------------------------------------------------------------------
> Networks, Ericsson Research
> ----------------------------------------------------------------------
> Ericsson AB                 | Mobile [phone]
> Torshamnsgatan 23           |
> SE-164 80 Stockholm, Sweden | mailto: [e-mail]
> ----------------------------------------------------------------------
>
>
> _______________________________________________
> dtn mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtn