Re: [lisp] LISP crypto

Amjad, we are aware of the QC-safe work going on in CFRG. We are following it but it is very researchy at this point. We can add some text indicating that we’ll follow any CFRG/SAAG recommendations (or any security area working group’s recommendation) on using QC-safe technology.

If there is anything specific you want us to look at with IKE, please send some pointers. Thanks.

Dino

> On Nov 5, 2015, at 10:37 AM, Amjad Inamdar (amjads) <amjads@cisco.com> wrote:
> 
> Hi Brian/Dino,
>  
> The key material derivation proposed in draft-ietf-lisp-crypto is based on Diffie-Hellman which is not Quantum Computer resistant. There is some work underway to make IKE that uses DH for key derivation Quantum Computer safe. Might be a good idea to consider this for lisp-crypto as well.
>  
> Thanks,
> -Amjad
>  
> From: Amjad Inamdar (amjads) 
> Sent: 03 November 2015 PM 12:33
> To: 'lisp@ietf.org'
> Subject: LISP NAT Traversal
>  
> Hi,
>  
> It will be useful if LISP NAT traversal draft (draft-ermagan-lisp-nat-traversal) can elaborate on the following
>  
> 1) Why LISP NAT traversal cannot be accomplished without RTR (another network entity) which has implications on deployability, complexity and latency. There are other protocols (e.g IKE/IPsec) that achieve NAT-D and NAT-T without the need for additional network entity.
>  
> 2) Some more details on RTR deployment
> - location of RTR in the LISP deployment like there are recommendations on PITR/PETR deployments
> - is RTR shared across LISP sites behind NAT or each site needs a dedicated RTR
> - what if RTR is behind another NAT (SP-NAT)
>  
> 3) How is multiple-NAT handled (e.g. enterprise and SP NAT)
>  
> Thanks,
> -Amjad Inamdar CISSP, CCNP R&S, CCNP Security, CCDP, CCSK
> Senior Technical Leader
> CSG PI Services Security - India  
>  
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp