IETF Logo Mail Archive

Re: [perpass] Fwd: FW: I-D Action: draft-farrelll-mpls-opportunistic-encrypt-00.txt

Leif Johansson <leifj@mnt.se> Sat, 11 January 2014 00:32 UTC

Return-Path: <leifj@mnt.se>
X-Original-To: perpass@ietfa.amsl.com
Delivered-To: perpass@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B55721A8034 for <perpass@ietfa.amsl.com>; Fri, 10 Jan 2014 16:32:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uCR-YOui-jNa for <perpass@ietfa.amsl.com>; Fri, 10 Jan 2014 16:32:33 -0800 (PST)
Received: from mail-la0-f45.google.com (mail-la0-f45.google.com [209.85.215.45]) by ietfa.amsl.com (Postfix) with ESMTP id 3D31B1A1F4C for <perpass@ietf.org>; Fri, 10 Jan 2014 16:32:32 -0800 (PST)
Received: by mail-la0-f45.google.com with SMTP id b8so2017365lan.32 for <perpass@ietf.org>; Fri, 10 Jan 2014 16:32:22 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=rFghg4tL39Y/N0yAjbynB8aDdf2sQqnexYhebNBXbdU=; b=QIbLD7Utwm4TzUK8k2CKoSVXDHyJ3nDURVSmlW6mPc9jl2UufPpoUdBRqCtZcGHXt4 UTBiPzUyFo48Wc/Iy7qEyjFSg2Af7ast5ShEIIiUL+BsXkvzhlef8pU6UNiY5OSXMc65 riEsnr2StbFRZxOjLd5tp1aykqhz7wCz3XMioCq7nCom452iTtVGACi7aIRitn1dRNt7 l/mrEaEgbIjZ/Xzng8FZdBHOI4/dJY/N8Q43pCHciTfxBEFzEwq8StuKnesDDmGir5Dw UnaGK9JPCwZllZGlnq7fwRB1ms8pYYJUikdhpicOopCsHgSBgeBtiNkWYZWsmM6P55CX UR9A==
X-Gm-Message-State: ALoCoQmLAE7VygicLyCmPjKTGeBd6PVvNTGCgueMuShJ9EzWveCNWQPSgiBqm0shGQJOohgnsagA
X-Received: by 10.112.180.37 with SMTP id dl5mr4706368lbc.58.1389400339532; Fri, 10 Jan 2014 16:32:19 -0800 (PST)
Received: from [10.0.0.159] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by mx.google.com with ESMTPSA id c15sm4385263lbq.11.2014.01.10.16.32.17 for <perpass@ietf.org> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 10 Jan 2014 16:32:18 -0800 (PST)
Message-ID: <52D09111.7010009@mnt.se>
Date: Sat, 11 Jan 2014 01:32:17 +0100
From: Leif Johansson <leifj@mnt.se>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: perpass@ietf.org
References: <mailman.42.1389384009.839.perpass@ietf.org> <52D062BB.1030906@gmail.com>
In-Reply-To: <52D062BB.1030906@gmail.com>
X-Enigmail-Version: 1.6
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 8bit
Subject: Re: [perpass] Fwd: FW: I-D Action: draft-farrelll-mpls-opportunistic-encrypt-00.txt
X-BeenThere: perpass@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "The perpass list is for IETF discussion of pervasive monitoring. " <perpass.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/perpass>, <mailto:perpass-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/perpass/>
List-Post: <mailto:perpass@ietf.org>
List-Help: <mailto:perpass-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/perpass>, <mailto:perpass-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 11 Jan 2014 00:32:36 -0000

On 2014-01-10 22:14, Yaron Sheffer wrote:
> Hi Stephen,
>
> I haven't read the protocol yet (although I must say Sec. 4.3 worries
> me, it reminds me of the renegotiation vulnerability), but:
>
> - I understand MPLS traffic is often protected at a higher layer by
> IPsec. If we had a good opportunistic 
I don't think that’s true at all in real-world deployments.
> solution for IKE/IPsec, it could also cover this use case. And we know
> people are working on such solutions. [Here, that's me and my little
> turf war].
>
> - But even at layer 2, there are existing solutions like WPA or
> MacSec. Can none of them be used (or extended) for this use case and
> do we really have to develop both the bulk encryption and key exchange
> from scratch? Sorry to be such a spoilsport.
>
> Thanks,
> Yaron
> _______________________________________________
> perpass mailing list
> perpass@ietf.org
> https://www.ietf.org/mailman/listinfo/perpass

v2.30.2 | Report a Bug | By Email | System Status