Re: [IPsec] WG Review: IP Security Maintenance and Extensions (ipsecme)

[Yoav Nir <[e-mail]>]

I don't really agree with this. Different vendors would want different  
things in the "ticket". So much so, that if we insist on including it,  
one of two things will happen: (1) We will fail to reach consensus or  
some vendors implement their own private version, or (2) We will end  
up with a monstrous structure with IETF-specified and vendor-specific  
extensions.

Just as a for-instance, I'll give some examples of what may or may not  
be in the ticket:
1. My company makes VPN software that runs of commodity servers. These  
servers run on regular X86 processors and come with 100's of gigabytes  
of disk space. It's fairly easy for me to save the IKE SA to disk upon  
its creation, perhaps in a database with a unique 64-bit key, and send  
that 64-bit key as the "ticket". After a crash, the database is still  
there. Other vendors run on systems with either no disk or very  
limited disk space, sometimes flash-based. They can't store their SAs  
on disk.
2. With AAA servers you sometimes get authorization information from  
the server during the log-in process. In such a case, the ticket (or  
its persistent record) must hold the authorization information (you  
either can't or don't want to query the AAA server for that  
information during resumption). Other vendors may not rely on AAA  
servers for authorization.
3. User identity may sometimes be stored as a simple string (ASCII or  
UTF8), as a DN, as an email address extracted from the DN or from an  
alternate name in the certificate, or we may want to keep the user  
identity as their public key.

Since failover from one gateway to another is out of scope, let alone  
a failover from one gateway to a gateway made by a different vendor,  
interoperability does not suffer by not specifying a ticket. We can  
and should specify security considerations and what data the gateway  
should be able to reconstruct based on the ticket, but format should  
be out of scope.

On Jul 28, 2008, at 7:04 PM, Dan Harkins wrote:

>
>  Hi,

<snip>

>
>  A bigger issue, though, concerns the construction of the "ticket".  
> I'd
> like to know why this is out-of-scope. I can see the possibility of
> consensus forming in the WG around a document that does not specify
> construction of the "ticket" but that doesn't mean the topic should be
> out-of-scope. How the "ticket" get constructed will influence the  
> security
> of the scheme. A properly constructed "ticket" may even help address  
> DoS
> issues. This topic should be in scope. It seems very wrong that we  
> would
> generate a standards track document in the Security Area with a  
> critical
> component of the security of the proposal being left up to the  
> imagination
> of the guy implementing it.

_______________________________________________
IPsec mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/ipsec