RE: [MBONED] WGLC for <draft-ietf-mboned-ipv4-uni-based-mcast-04.txt>

["Manfredi, Albert E" <[e-mail]>]

> -----Original Message-----
> From: Toerless Eckert [mailto:[e-mail]] 

> Nobody has clearly answered me yet how it can be within the
> security requirements of the IETF to do something like ASM across 
> a completely untrustworthy scope like the Internet (without creatng
> a mandatory spec dependency against a security layer - and just
> saying IPsec is not sufficient, because it would only allow
> discarding of unwanted traffic due to missing authentication _AFTER_
> that traffic has wasted bandwidth to a potentially large number of
> receivers).

Probably not across the Internet, I agree.

> Obviously, ASM is very convenient to applications, so as soon as
> the scope is sufficiently well controllable, there's nothing bad
> about using ASM. Those scopes are usually structured such that
> one can also more easily move to Bidir. Let's call them enterprises.

Yup. In these cases, it can be more convenient to have the network
filter the allowable source devices, and keep the clients as simple as
possible. It may well be easier to maintain security this way, over
time, as source devices are added or changed, or as mpt-mpt networks of
multifunction consoles (for example) are upgraded.

Bert


_______________________________________________
MBONED mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mboned