Re: [secdir] secdir review of draft-ietf-mext-aero-reqs8

["Davis, Terry L" <[e-mail]>]

Steve

Sorry if I confused this issue in this way.  Aviation does not want to be "special" in any area; PKIs or protocols.  And aviation has long recognized that no single PKI will ever serve it; hence our creation of the Exostar Certipath bridge.  By governmental requirements around the globe, we will deal with a multitude of different PKIs and specific key/hash requirements in our environment.  We want to use generic standard Internet services but our security environment will be more demanding than a typical enterprise or agency as we move from OSI to IP for new aviation communications.

Aviation will be the first try (I'm aware of) at utilizing the IP security protocols in a truly dynamic global heterogeneous environment.
- An aircraft will have generally 1 to 4 active communications links at any given time.

- These will change almost continually between service providers and ground portals.

- Some aircraft, especially those that do continuous global circle routes, will have 20 or more service providers for those various links in a 48 hour period.

- Each service provider is likely to have its' own unique security environment and PKI.

- There is no onboard IT staff!  It all has to happen automatically to make new security associations with the next link provider.

Hence my skepticism on our ability to utilize the IP security protocols (regardless how you spell IPSec ;-) in a dynamic global mobile environment.

If the IETF had not adopted the DHCP protocols they were provided with over 15 years ago, we would not have global roaming connectivity today.  No hotspots, no international hotel usage, no laptop portability even between sites within the laptop's own enterprise, etc.  

And providing global "dynamic security association negotiation" is outside of the scope of IETF standards?

To me, not providing a simple "dynamic security association" to insure that our security protocols are fully interoperable and easily implementable in a heterogeneous environment between different vendors would be an abdication of our responsibility to the security of the Internet.

I'll leave at "I think we have some more work to do!"

Take care
Terry

PS: You can see some of these same issues in the various CI sectors also as they attempt interoperation of between the various entities within sectors.

> -----Original Message-----
> From: Stephen Kent [mailto:[e-mail]]
> Sent: Monday, August 24, 2009 7:10 PM
> To: Davis, Terry L
> Cc: 'Sam Hartman'; [e-mail]; [e-mail]; 'Ivancic, William D.
> (GRC-RHN0)'; [e-mail]; [e-mail];
> [e-mail]
> Subject: Re: [secdir] secdir review of draft-ietf-mext-aero-reqs8
> 
> At 3:48 PM -0700 8/21/09, Davis, Terry L wrote:
> >Sam
> >
> >One of the items that continues to seriously concern me across the
> >whole IP protocol RFC set is the basic lack of simple
> >vendor-to-vendor IP security interoperability!  All of NEMO and MEXT
> >assumes that simple, easy to implement, IPSec, PKI, and IKE
> >interoperability exist; they do NOT.
> 
> Terry,
> 
> IPsec (not IPSec :-)) and IKE have been available in major host
> operating systems for a few years, so the phrase "easy to implement"
> is not generally a true assertion.  Are you stating that the aviation
> industry needs to implement its own versions of these and analogous
> Interent protocols? Also, as for interoperability, I believe Paul
> Hoffman has reported a number of good results through his VPNC
> testing experiences.
> 
> As for PKI, there are relying party implementations in all browsers,
> and in some OSes, and OpenSSL.  The browsers interoperate with web
> servers (using SSL) developed by a few different vendors, which is a
> decent demo of interoperability for core PKI features. OpenCA and
> OpenSSL are decent (not perfect) examples of open source software for
> both RP and CA functions.
> 
> Later you seem to be arguing that a single PKI (vs. IETF PKI and
> IPsec/IKE standards) is an essential feature for IPsec solutions.
> This is clearly not true in general. Is this another situation where
> aviation is "special?"
> 
> I will not disagree with your assertion that many of the Ipsec/IKE
> and PKI products have hard to configure admin interfaces. But, that
> is an issue outside the scope of IETF standards. Also, I would
> observe that the typical CLI for a router is not an easy to use
> interface either.
> 
> 
> Steve