RE: [netlmm] Issue: Auth Option support

Hi Julien,

> -----Original Message-----
> From: julien laganier [mailto:julien.laganier@gmail.com] On 
> Behalf Of Julien Laganier
> Sent: Friday, September 07, 2007 5:29 AM
> To: netlmm@ietf.org
> Cc: Sri Gundavelli; 'Alper Yegin'
> Subject: Re: [netlmm] Issue: Auth Option support
> 
> Hi Sri,
> 
> On Thursday 06 September 2007, Sri Gundavelli wrote:
> > I'm confused, should the draft say
> >
> > "Both LMA and MAG MUST implement IPsec" and
> > "all the signaling messages SHOULD be protected using IPSec".
> >
> > Will this ok, when reviewed by the security folks ?
> >
> > or mandate IPsec for this specification and let other draft
> > relax this in the presence of an alternative approach ?
> >
> > Please comment.
> 
> Somehow, "MUST implement" and "SHOULD use" together seems a bit 
> tautologic. 
> 
> To me "SHOULD use" is sufficient since it covers both of the two 
> possibles cases:
> 
> - deployment follows the SHOULD recommendation, it uses IPsec 
> to protect 
> PMIPv6, in which case it supports it, since it's using it :), or
> 
> - deployment ignores the SHOULD recommendation, does not uses 
> IPSec, in 
> which case it is useless to implement it since it's not used...
> 
> I'd prefer having "MUST protect integrity of signalling messages, and 
> SHOULD use IPsec ESP to protect integrity of those messages". 
> We might 
> also add "MAY use IPsec AH".
> 

I agree. I'm not against allowing other approaches. I'm only concerned,
if we can leave the draft saying, "MUST protect integrity of signalling
messages", with out specifying IPsec or some other approach. If that
will pass the security review. We may have to state that IPsec MUST be
used or some other approach, say Auth-Option MUST be used. Not sure, if
we can leave this blank.

Sri

_______________________________________________
netlmm mailing list
netlmm@ietf.org
https://www1.ietf.org/mailman/listinfo/netlmm