Re: Last Call: Security Architecture for the Internet Protocol to Proposed Standard

["Howard C. Berkowitz" <[e-mail]>]

At 14:46 -0500 3/31/98, C. Harald Koch wrote:
>In message <v0300780bb146a2d106bd@[142.154.136.3]>, "Howard C. Berkowitz"
>writes:
>>
>> Stating things more succinctly, I think the architecture document,
>> specifically, does not either discuss proxy vs. end-to-end functions in the
>> context of risk analysis, nor does it reference a document that does.
>> There have been strong arguments about the interactions of IPsec and
>> various proxy and proxy-like functions, including NAT, satellite spoofing,
>> firewalls, etc.  Perhaps some guidance from the IESG or IAB is in order,
>> clarifying how the IETF will build consensus on the interaction of these
>> security and infrastructure technologies. Specific commentary on the effect
>> of widespread IPsec deployment on the demand for globally routable IPv4
>> space, under various scenarios of IPsec tunneling, should be considered.
>
>None of these were in the Charter for the IPsec working group. This was
>deliberate; they're hard problems.

I can get along with stating thing in those terms, although I would suggest
that this conscious limiting doesn't come across in the architecture
document.  Again, my concern is that the enterprise network architect
realistically is not going to go back to the charter.  If things are
consciously out of scope, a pointer to that would help enormously in
getting deployed.

Your points are well taken and my comments are meant to be supportive of
the overall effort.  I do in fact monitor IPsec drafts, but, I think
realistically as do many others, I actively comment in only a certain
subset of the WGs. If something reaches last call, and especially if it is
impacting other areas of work, it seems appropriate to me to try to build
consensus and clarity.  That is the point of my comments, I want the work
to be used.  I don't want to see things happen such as people coming into
NAT, etc., and saying "you can't do this because it breaks IPsec."
>
>Many of them are (or will be) in the Charter for the IPsecond working group,
>and I'm sure we'd love to have you participate in those discussions.

I'd be happy to do so, especially within my area of specialization, which
is more routing and addressing.  I fully recognize the need to limit the
scope of work in order to get things done.
>
>
>There's precedent for splitting work like this, after all. We're up to RIPv2,
>SNMPv3, and BGPv4 right now, after all.

Given the IPsecond effort is being formed, does it make sense to identify
the current document as IPsec V1?  Seriously, I think that would help among
nonspecialists.

Your comments are valid, and I hope mine are taken in the constructive way
they are meant.  I've killfiled Mr. Metzger.


Howard