Re: [netlmm] Issue: Auth Option support

Julien Laganier wrote:
> Hi Sri,
> 
> On Thursday 06 September 2007, Sri Gundavelli wrote:
>> I'm confused, should the draft say
>>
>> "Both LMA and MAG MUST implement IPsec" and
>> "all the signaling messages SHOULD be protected using IPSec".
>>
>> Will this ok, when reviewed by the security folks ?
>>
>> or mandate IPsec for this specification and let other draft
>> relax this in the presence of an alternative approach ?
>>
>> Please comment.
> 
> Somehow, "MUST implement" and "SHOULD use" together seems a bit 
> tautologic. 
> 
> To me "SHOULD use" is sufficient since it covers both of the two 
> possibles cases:
> 
> - deployment follows the SHOULD recommendation, it uses IPsec to protect 
> PMIPv6, in which case it supports it, since it's using it :), or
> 
> - deployment ignores the SHOULD recommendation, does not uses IPSec, in 
> which case it is useless to implement it since it's not used...
> 
> I'd prefer having "MUST protect integrity of signalling messages, and 
> SHOULD use IPsec ESP to protect integrity of those messages". We might 
> also add "MAY use IPsec AH".

I'm not sure what you mean...

Do you mean to use ESP to offer authentication (integrity protection)? 
I'd suggest to make AH a should, for this purpose, not ESP.

Or do you mean to use ESP to offer confidentiality (encrypted packets)? 
  In this case, ESP is the only possibility to do confindentiality, 
because authopt doesn't; so not sure why needing to debate the use of 
ESP for confidentiality, it is pretty clear.

Also, when you say to protect integrity of signalling messages, which of 
those do you assume?  authopt only does bu/back, it doesn't do other 
mip6 signalling.  So I think you only assume integrity of bu/back, right?

Alex

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

_______________________________________________
netlmm mailing list
netlmm@ietf.org
https://www1.ietf.org/mailman/listinfo/netlmm