IETF Logo Mail Archive

Re: SOI: identity protection and DOS

Michael Thomas <mat@cisco.com> Wed, 21 November 2001 23:32 UTC

Received: from lists.tislabs.com (portal.gw.tislabs.com [192.94.214.101]) by above.proper.com (8.11.6/8.11.3) with ESMTP id fALNWN800186; Wed, 21 Nov 2001 15:32:23 -0800 (PST)
Received: by lists.tislabs.com (8.9.1/8.9.1) id RAA16978 Wed, 21 Nov 2001 17:37:03 -0500 (EST)
From: Michael Thomas <mat@cisco.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-ID: <15356.11908.141636.804339@thomasm-u1.cisco.com>
Date: Wed, 21 Nov 2001 14:45:24 -0800
To: Henry Spencer <henry@spsystems.net>
Cc: Michael Thomas <mat@cisco.com>, ipsec@lists.tislabs.com
Subject: Re: SOI: identity protection and DOS
In-Reply-To: <Pine.BSI.3.91.1011120231925.1751D-100000@spsystems.net>
References: <15354.45414.23171.182987@thomasm-u1.cisco.com> <Pine.BSI.3.91.1011120231925.1751D-100000@spsystems.net>
X-Mailer: VM 6.72 under 21.1 (patch 6) "Big Bend" XEmacs Lucid
X-Face: &, heK/V66p?[2!i|tVn, 9lN0TUvEv7:9FzXREj/AuzN4m<D]vnFJ>u!4x[/Z4t{V}~L]+Sk @RFNnJEg~WZ/(8<`5a), -7ukALWa^&?&D2R0CSG3kO5~#6JxLF\d, g">$%B!0w{W)qIhmwhye104zd bUcI'1!
Sender: owner-ipsec@lists.tislabs.com
Precedence: bulk

Henry Spencer writes:
 > You have not actually established your key underlying assumption, that
 > identity protection necessarily involves substantial extra cost.
 > 
 > The proposed IKEv2, if I've read the spec correctly, establishes both
 > an ISAKMP SA and a set of IPsec SAs, *with* full identity protection,
 > in 2 round trips.  It is difficult to imagine improving on that.
 > 
 > (IKE needs 2.5 round trips *without* identity protection.)

   Fine, then IKEv2 meets my proposed requirement. That
   doesn't negate the requirement, or the reason to have it.
   We are still talking about requirements, right? 

	  Mike

v2.37.1 | Report a Bug | By Email | System Status