Re: [dtn] [EXTERNAL] BPbis consensus status

[Magnus Westerlund <[e-mail]>]

Hi,

Personal opinions below. 

Marc, I think comparing BPSec with IP and IPsec is wrong for several reasons. I
think one of the more significant ones are related to the identification of the
peer entitity and who you are and establishing security between these two
entities end-to-end. IPSec is to low level for that to work in the Internet as
endpoint or possibly whole networks (due to NATs) exist under the umbrella of an
IP address. However, I don't see that being the case for BP. Here BP can address
the applicaiton specifically and create security association end-to-end between
the application entities on different nodes. Becasue the BP agent can provide
unique DTN addresses for each application and establish different BPSec security
contexts to prevent this missmatch. So BPSec has all the chance of being the
basic security layer end-to-end that IPsec never succed as. 

Yes, there are hurdle to get the details for security contexts (security
profile) and its key-management done. But without this I don't see how DTN will
even become more that narrow nichese where it is used ontop of a private
network. There are some utility in that, but far from the promise of the network
and networks for delay tolerant applications that could use a interwork layer. I
think BP can succeed, but not without a security solution that work and are
generally available and supported. 

Cheers

Magnus




On Thu, 2020-09-17 at 18:46 -0400, R. Atkinson wrote:
> > On Sep 16, 2020, at 23:25, Marc Blanchet <[e-mail]> wrote:
> > ... as current Internet deployment tells us, the applications need to be
> > aware
> > of security services ...
> 
> Marc,
> 
> Your words above - to the extent they are true — are a reason 
> to have a well documented BPsec API which applications can use
> if/when appropriate.
> 
> Such an API probably should be documented in an Informational RFC.
> Is that something you might want to undertake — since you are so
> passionate about it ??
> 
> From a logic perspective, those words quoted above are really NOT a reason 
> for  BPsec to be optional to implement.
> 
> Yours,
> 
> Ran
> 
> _______________________________________________
> dtn mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtn
-- 
Cheers

Magnus Westerlund 


----------------------------------------------------------------------
Networks, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Mobile [phone]
Torshamnsgatan 23           |
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------