Re: [RPSEC] Re: Using IPSec for Routing Protocols

Sandhya,
See inline.
Sandhya Chawla wrote:

>Hi Stephane,
>
>--- Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
>
>  
>
>>On Thu, May 04, 2006 at 05:15:21AM +0100,
>> Sandhya Chawla <sandhya.chawla@yahoo.co.in> wrote 
>> a message of 50 lines which said:
>>
>>    
>>
>>>Why are we working on providing security at each routing protocol
>>>(application layer)? Why cant we simply use IPSEC for this?
>>>      
>>>
>>Wild guess from a non-expert: because IPsec only provides channel
>>security, not data security. For instance, if I have a BGP connection
>>    
>>
>
>We could use ESP will null encryption (null cipher). Using NULL as we really dont want to provide
>any confidentiality. We only want to authenticate the sender and want to make sure that no one
>mangles the packet in between.
>
>  
>
>>with a peer, I can use IPsec and therefore be sure that the peer is
>>really what it says it is. But what does it buy me when the peer
>>announces a route? How can I be sure that he is entitled to announce
>>this route? 
>>    
>>
>
>Yes, i understand the need for SO-BGP and S-BGP. What about the IGPs? We would perhaps not want to
>go in for the complexity of issuing certificates, etc for IGPs. Would we?
>  
>
I would hope not. Though there have been experiments in this area.

>If not, then why cant we simply use IPSEC to protect and auth my IGP data?
>  
>
There have been some challenges in using IPSec but the draft should be 
published soon.

http://www.ietf.org/internet-drafts/draft-ietf-ospf-ospfv3-auth-08.txt

Work is underway to provide the IPSec for OSPFv2 as well.

Acee

>I understand that IPSEC works best for, and is perhaps currently defined only for unicast traffic.
>Is this the reason because of which we cant use IPSEC for IGPs (OSPF)?
>
>Regards,
>Sandhya
>
>  
>
>>(Analogy: showing me your passport can convince me that you are indeed
>>Sandhya Chawla. But it does not make any difference when you tell me
>>that Om Prakash Chautala is an honest man or not: I still have to
>>check the information.)
>>
>>For the same reason, IPsec does not make the DNS safer and we need
>>DNSsec.
>>
>>    
>>
>
>
>
>		
>__________________________________________________________ 
>Yahoo! India Answers: Share what you know. Learn something new. 
>http://in.answers.yahoo.com
>
>_______________________________________________
>RPSEC mailing list
>RPSEC@ietf.org
>https://www1.ietf.org/mailman/listinfo/rpsec
>
>  
>

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec