RE: [netlmm] Issue: Auth Option support

Hope this is never too late.

My understanding is that for any implementation to claim compliancy to
any RFC, that implementation MUST implement all "MUST" and "SHOULD".
Having said that, I am not sure why we need this distinction of "MUST
implement IPsec" and "SHOULD use IPsec", that is exactly the meaning of
"SHOULD use IPsec".

Regards,
Ahmad

> -----Original Message-----
> From: Narayanan, Vidya [mailto:vidyan@qualcomm.com] 
> Sent: Friday, September 07, 2007 2:27 PM
> To: Sri Gundavelli; Julien Laganier; netlmm@ietf.org
> Subject: RE: [netlmm] Issue: Auth Option support
> 
> All,
> On this topic, I believe we must have a mandatory to 
> implement mechanism specified for standards track 
> publication.  We can leave the use at "RECOMMENDED" or 
> "SHOULD", but, we need a "MUST" on what the LMA and MAG need 
> to implement.  
> 
> I had run this by the security directorate at the Chicago 
> meeting and my understanding is that as long as we have "MUST 
> implement IPsec" and "SHOULD use IPsec", it would be fine.  
> 
> In other words, the SHOULD vs. MUST that we want to place on 
> using IPsec can be discussed, but, the "MUST" on 
> implementation is non-negotiable.  
> 
> This is inline with my understanding on what we need to state 
> for a complete specification.  Given that channel security of 
> signaling messages is mandatory, unless we have at least one 
> common denominator that the MAG and LMA implementors will 
> implement, we cannot ensure interoperability.  If they 
> support multiple common mechanisms and chose to use something 
> other than IPsec, that's fine - hence, the "SHOULD" on usage. 
> 
> Hope that helps. 
> 
> Thanks,
> Vidya
> 
> > -----Original Message-----
> > From: Sri Gundavelli [mailto:sgundave@cisco.com]
> > Sent: Friday, September 07, 2007 10:10 AM
> > To: 'Julien Laganier'; netlmm@ietf.org
> > Subject: RE: [netlmm] Issue: Auth Option support
> > 
> > Hi Julien,
> > 
> >  
> > 
> > > -----Original Message-----
> > > From: julien laganier [mailto:julien.laganier@gmail.com] On
> > Behalf Of
> > > Julien Laganier
> > > Sent: Friday, September 07, 2007 5:29 AM
> > > To: netlmm@ietf.org
> > > Cc: Sri Gundavelli; 'Alper Yegin'
> > > Subject: Re: [netlmm] Issue: Auth Option support
> > > 
> > > Hi Sri,
> > > 
> > > On Thursday 06 September 2007, Sri Gundavelli wrote:
> > > > I'm confused, should the draft say
> > > >
> > > > "Both LMA and MAG MUST implement IPsec" and "all the signaling 
> > > > messages SHOULD be protected using IPSec".
> > > >
> > > > Will this ok, when reviewed by the security folks ?
> > > >
> > > > or mandate IPsec for this specification and let other 
> draft relax 
> > > > this in the presence of an alternative approach ?
> > > >
> > > > Please comment.
> > > 
> > > Somehow, "MUST implement" and "SHOULD use" together seems a bit 
> > > tautologic.
> > > 
> > > To me "SHOULD use" is sufficient since it covers both of the two 
> > > possibles cases:
> > > 
> > > - deployment follows the SHOULD recommendation, it uses IPsec to 
> > > protect PMIPv6, in which case it supports it, since it's
> > using it :),
> > > or
> > > 
> > > - deployment ignores the SHOULD recommendation, does not
> > uses IPSec,
> > > in which case it is useless to implement it since it's not used...
> > > 
> > > I'd prefer having "MUST protect integrity of signalling
> > messages, and
> > > SHOULD use IPsec ESP to protect integrity of those messages".
> > > We might
> > > also add "MAY use IPsec AH".
> > > 
> > 
> > 
> > I agree. I'm not against allowing other approaches. I'm only 
> > concerned, if we can leave the draft saying, "MUST protect 
> integrity 
> > of signalling messages", with out specifying IPsec or some other 
> > approach. If that will pass the security review. We may 
> have to state 
> > that IPsec MUST be used or some other approach, say 
> Auth-Option MUST 
> > be used. Not sure, if we can leave this blank.
> > 
> > Sri
> > 
> > 
> > _______________________________________________
> > netlmm mailing list
> > netlmm@ietf.org
> > https://www1.ietf.org/mailman/listinfo/netlmm
> > 
> 
> _______________________________________________
> netlmm mailing list
> netlmm@ietf.org
> https://www1.ietf.org/mailman/listinfo/netlmm
> 

_______________________________________________
netlmm mailing list
netlmm@ietf.org
https://www1.ietf.org/mailman/listinfo/netlmm