Re: [perpass] Fwd: FW: I-D Action: draft-farrelll-mpls-opportunistic-encrypt-00.txt

[Yaron Sheffer <[e-mail]>]

> On Fri, 10 Jan 2014, Stephen Farrell wrote:
>
>>> - I understand MPLS traffic is often protected at a higher layer by
>>> IPsec. If we had a good opportunistic solution for IKE/IPsec, it could
>>> also cover this use case. And we know people are working on such
>>> solutions. [Here, that's me and my little turf war].
>>
>> I think opportunistic IPsec could certainly help yes. I'm not
>> sure if this use-case is being considered in that work.
>
> Any non host-host case is very hard, as there is no way to verify any
> claims for random subnets of the internet. AFAIK, no good methods exist
> that any OE IPsec could use for auto-configuration. There is quite a
> difference between "here is plaintext from you to Bob, encrypt it" and
> "here is plaintext from you to Bob at 8.8.8.0/24, encrypt to Mallory".
>
This is different from the normal IPsec OE scenario, and as a result may 
be easier to solve:
- The MPLS peer is already willing to send any traffic from the private 
network to the other peer, which it sincerely hopes is not a MITM.
- Each peer is typically running on an edge router (I believe) and so 
has much more awareness of the network than your typical IPsec OE peer. 
They will actually have the BGP information.

Thanks,
	Yaron