Re: [lisp] LISP crypto

Okay, thanks for input Stephen, appreciated.

Dino

> On Nov 5, 2015, at 4:23 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
> 
> 
> 
> On 06/11/15 00:03, Dino Farinacci wrote:
>> Amjad, we are aware of the QC-safe work going on in CFRG. We are
>> following it but it is very researchy at this point. 
> 
> Correct. It would be premature IMO to try to incorporate any
> functionality that aims to mitigate QC attacks against
> asymmetric crypto since we're not at a point where we know how
> to do that effectively and efficiently.
> 
>> We can add some
>> text indicating that we’ll follow any CFRG/SAAG recommendations (or
>> any security area working group’s recommendation) on using QC-safe
>> technology.
> 
> I don't think that's needed myself.
> 
> S.
> 
>> 
>> If there is anything specific you want us to look at with IKE, please
>> send some pointers. Thanks.
>> 
>> Dino
>> 
>>> On Nov 5, 2015, at 10:37 AM, Amjad Inamdar (amjads)
>>> <amjads@cisco.com> wrote:
>>> 
>>> Hi Brian/Dino,
>>> 
>>> The key material derivation proposed in draft-ietf-lisp-crypto is
>>> based on Diffie-Hellman which is not Quantum Computer resistant.
>>> There is some work underway to make IKE that uses DH for key
>>> derivation Quantum Computer safe. Might be a good idea to consider
>>> this for lisp-crypto as well.
>>> 
>>> Thanks, -Amjad
>>> 
>>> From: Amjad Inamdar (amjads) Sent: 03 November 2015 PM 12:33 To:
>>> 'lisp@ietf.org' Subject: LISP NAT Traversal
>>> 
>>> Hi,
>>> 
>>> It will be useful if LISP NAT traversal draft
>>> (draft-ermagan-lisp-nat-traversal) can elaborate on the following
>>> 
>>> 1) Why LISP NAT traversal cannot be accomplished without RTR
>>> (another network entity) which has implications on deployability,
>>> complexity and latency. There are other protocols (e.g IKE/IPsec)
>>> that achieve NAT-D and NAT-T without the need for additional
>>> network entity.
>>> 
>>> 2) Some more details on RTR deployment - location of RTR in the
>>> LISP deployment like there are recommendations on PITR/PETR
>>> deployments - is RTR shared across LISP sites behind NAT or each
>>> site needs a dedicated RTR - what if RTR is behind another NAT
>>> (SP-NAT)
>>> 
>>> 3) How is multiple-NAT handled (e.g. enterprise and SP NAT)
>>> 
>>> Thanks, -Amjad Inamdar CISSP, CCNP R&S, CCNP Security, CCDP, CCSK 
>>> Senior Technical Leader CSG PI Services Security - India
>>> 
>>> _______________________________________________ lisp mailing list 
>>> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>> 
>> _______________________________________________ lisp mailing list 
>> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>> 