Re: [secdir] SecDir review of draft-ietf-keyprov-pskc-05

["Philip Hoyer" <[e-mail]>]

Vincent,
I have changed the draft to encompass your revised wording of point 2
below.

Thanks for your help,

Philip

-----Original Message-----
From: Vincent Roca [mailto:[e-mail]] 
Sent: Monday, May 17, 2010 11:09 AM
To: Philip Hoyer
Cc: [e-mail]; [e-mail];
[e-mail]; [e-mail]
Subject: Re: SecDir review of draft-ietf-keyprov-pskc-05

Hello Philip,

I see we agree on most items (I removed them). Two comments:

> 5- section 13.1:
>     why isn't the IPsec/ESP not considered also as a third
>     solution to provide the confidentiality, integrity and sender
>     authentication services? Why do the authors only focus
>     on PCKS integrated or TLS solutions? It's not clear.
> [PH] the authors felt that the usage of the container was intended for
> application level interchange of keys. Especially in online scenarios
> where TLS is much more prevalent than IPSec. This does not mean that
one
> could not envisage use of the PSKC over IPsec and hence use IPsec
> protection mechanisms.
>    
[VR] I understand. Thanks for the clarification.

> 9- section 13.3: it is said:
> "A weaker payload authenticity guarantee may be provided by the
>   transport layer if it is configured to digest each message it
>   transports."
>
>     Why is this feature necessarily weaker? The source can be
>     authenticated with the same level of security as if it was
>     done by the recipient end.
> [PH] it is weaker in the sense that the TLS endpoints could differ
from
> the key provisioning endpoints. So in that sense the signature in the
> message would protect it from message sender to receiver.
>    
[VR] Said this way, I fully agree. I suggest you clarify the
I-D as well, e.g.:

"Authenticity guarantee may be provided by [...]. However, no
authenticity
verification is possible once [...]. Since the TLS endpoints could 
differ from
the key provisioning endpoints, this solution is weaker than the
previous
solution that relies on a digital signature of the PSKC."

Cheers,

     Vincent