Re: [sidr] WGLC draft-sidr-rpki-rtr - take 2?

[Sandra Murphy <[e-mail]>]

On Fri, 3 Jun 2011, Uma Chunduri wrote:

>
>
....

>
> True, privacy through SSH is overkill but strong AUTH is *critical*, I feel:
>   - TCP-MD5 should not be considered (as it is any ways deprecated and it's MD5)
>   - TCP-AO has only slight advantage as it has less overhead than ipsec-AH even when
>     deployed with manual keys
>   - but it's better if it is "MUST support authentication of nodes with TCP-AO or ipsec-AH" because

Just to be sure:

Did you understand the part about implementations of TCP-AO and ipsec-AH 
not being available at present?

I.e., you recognize this forces a delay in implementation of the protocol 
(and accept the consequent impact on deployment of the RPKI)?

--Sandy, speaking as wg co-chair


>     as both support
>           - strong auth algos
>           - algo agility
>           - can be deployed with manual and auto key management
>            (auto key probably required eventually, once with lot of connections at
>             cache/global RPKI/server side and for automatic key
>             changes periodically)
>           - key changes for existing sessions
>
>    One would get flexibility with this.
>    Also Section 7 (page 16)
>    "It is assumed that the router and cache have exchanged keys out of band by some reasonably secured means"
>    This will be still applicable but only if TCP-AO/ipsce-AH are deployed with manual keys.
>
> 2 cents,
> -Uma
>
>
> _______________________________________________
> sidr mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sidr
>