Re: draft-ietf-ospf-ospfv3-auth-06.txt Ready for IESG review

[Mukesh Gupta <[e-mail]>]

Vishwas,

Comments inline :)

> Would it make more sense if we change the text "NULL encryption" 
> to "NULL encryption (for ESP) or no encryption (for AH)" ?
> VM> OK.

Ok.  We have consensus on one thing :)  We will take care of this
in the next rev.

> > VM> I still don't see a reason why we should talk about DES at all.
> I still don't understand why we can't use DES as an example of a weak
> encryption algorithm.  
> I would like to hear others' opnion about this ?  Acee?
> VM> I think examples should not be given of protocols which are on the
> "SHOULD NOT" list of IETF/NIST.

I still don't quite agree with you here.  Lets hear from others
on this !  Acee, what is your opinion on this ?

> VM> Yes, however I think we should be specifying a default 
> algorithm for
> OSPF(or are you saying you are not specifying any algorithms instead
> just directly pointing to the ESP/AH algorithms document).

I will cover this in the separate mail.  I am frankly quite
confused about what we want here :)

> We do refer to the vulnerabilities draft after the brief discussion
> of the replay vulnerabilities..  So are you ok with putting the
> text proposed above and then referring to the vulerabilities draft ?
> VM> As long as you put the text for the DoS case too, I am 
> ok. Else let us directly point to the vulnerabilities draft without 
> mentioning cases.

Another try on the text :)  How about the following + the already
existing text that refers to the vulnerability draft ?
===
"Replaying these type of packets can make the router spend some
resources.  Also when the OSPF adjacency is not FULL, replaying 
database description packets can cause disruption in forming the
adjacency which can lead to DoS attack on the network."
===

> VM> As Suresh rightly said ESN does not make sense with manual keying.
> So it is not about ESN alone. DSCP was one example I had pointed out
> too.

Would you be kind enough to propose some specific text and the place
in the draft where it should be added ?

> Thanks and sorry for bothering you,

You are not bothering us !  Thanks to you for reviewing the draft 
so many times and spending so much time on the issues.  We appreciate 
it !

Regards
Mukesh