[nasr] Re: 回复: Re: Secure Routing Path Consideration- China Mobile-ietf120

[Toerless Eckert <[e-mail]>]

On Fri, Oct 04, 2024 at 04:26:33PM -0400, Michael Richardson wrote:
>     > Depending on the technologies we emply in NAS, your could still have a stealth L2
>     > device though. Which by the way is a common way how firewalls operate.
> 
> yes there can always be rogue L2 devices, but:
> 
> 1) MACSEC, as you mentioned.

Actually, any hop-by-hop encryption, including the ones we use in ANIMA, IPsec, ...

I wish more interface hardware would support MacSEC. That was always what i hoped
to get from MacSEC compared to e.g.: IPsec.

> 2) QIRG, which is basically 2^MACSEC or something.
> 
>     >> b) that the two sides of each QIRG link are operating nominally.
> 
>     > Right.
> 
> MACSEC won't protect us from L2 copy-and-crack-later (worth repeating that a lot).
> QIRG could.

If there is MACsec support in the MIC HW, my past experience makes me believe  that
you could have 2 or more keys. So it should just be a matter of control plane
using some appropriately new quantum safe control plane encryption, and use that to change
the MacSEC symmetric AES265 crypto keys every few minutes. Aka: however fast you feel you can
run the control plane.

Cheers
    Toerless


> 
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
> 
> 



-- 
---
[e-mail]