Re: [mpls] FW: I-D Action: draft-farrelll-mpls-opportunistic-encrypt-00.txt

[Eric Rosen <[e-mail]>]

> wondering whether anything could be done to help protect against various
> types of bulk surveillance achieved by tapping entire links

Aren't there link layer encryption schemes that protect the confidentiality
of all traffic on the link?  I don't see why one would want an MPLS-specific
protocol for  "single hop" encryption.

I also don't understand the need for MPLS-specific "end-end" (probably
"edge-edge" is what is meant) encryption, as one can always send traffic
via IPsec.  

So, just what is the unsolved problem addressed by this draft?  (I was going
to ask whether RFC 5566 is relevant at all, but first it would be good to
get a clear statement of the scenarios that are being addressed.)

BTW, most of the draft seems to be about encryption and/or key distribution,
which of course is out of scope for this WG.  Surely the security ADs will
not tolerate having the MPLS WG invent new key distribution protocols.