IETF Logo Mail Archive

Re: SOI: identity protection and DOS

Henry Spencer <henry@spsystems.net> Wed, 21 November 2001 05:11 UTC

Received: from lists.tislabs.com (portal.gw.tislabs.com [192.94.214.101]) by above.proper.com (8.11.6/8.11.3) with ESMTP id fAL5Bi808910; Tue, 20 Nov 2001 21:11:45 -0800 (PST)
Received: by lists.tislabs.com (8.9.1/8.9.1) id XAA14755 Tue, 20 Nov 2001 23:19:24 -0500 (EST)
Date: Tue, 20 Nov 2001 23:27:57 -0500
From: Henry Spencer <henry@spsystems.net>
To: Michael Thomas <mat@cisco.com>
cc: ipsec@lists.tislabs.com
Subject: Re: SOI: identity protection and DOS
In-Reply-To: <15354.45414.23171.182987@thomasm-u1.cisco.com>
Message-ID: <Pine.BSI.3.91.1011120231925.1751D-100000@spsystems.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"
Sender: owner-ipsec@lists.tislabs.com
Precedence: bulk

On Tue, 20 Nov 2001, Michael Thomas wrote:
>    Which means that you're forced into a full round
>    trip first to protect the initiator's identity...

There has to be a round trip there, yes... but it doesn't necessarily have
to be an *extra* round trip, since you can get other things done at the
same time.

>    ...precisely why I think that identity
>    protection should be an optional tradeoff...

You have not actually established your key underlying assumption, that
identity protection necessarily involves substantial extra cost.

The proposed IKEv2, if I've read the spec correctly, establishes both
an ISAKMP SA and a set of IPsec SAs, *with* full identity protection,
in 2 round trips.  It is difficult to imagine improving on that.

(IKE needs 2.5 round trips *without* identity protection.)

                                                          Henry Spencer
                                                       henry@spsystems.net

v2.36.0 | Report a Bug | By Email | System Status