Re: [Tcpcrypt] New version of the charter text

[John-Mark Gurney <[e-mail]>]

marcelo bagnulo braun wrote this message on Wed, Apr 23, 2014 at 19:54 +0200:
> El 23/04/14 19:18, Joe Touch escribió:
> >
> >On 4/23/2014 10:04 AM, marcelo bagnulo braun wrote:
> >...
> >>>> The WG will define the
> >>>>TCP extensions to perform an unauthenticated key exchange resulting in
> >>>>encryption
> >>>>without authentication.
> >>>
> >>>This implies in-band.
> >>
> >>Yes, the idea here is to provide a fully automatic mechanism, that
> >>people simply install and dont need to configure keys or anything.
> >
> >That is orthogonal as to whether the key exchange is in-band.
> >
> >Yes, a key exchange mechanism needs to be defined as part of the 
> >system, but not necessarily inside the connection being protected.
> 
> mmm, havent considered that.
> So the key exchange mechanism would be part of the work of the WG, correct?
> 
> How do you envision doing it other than inside the connection? like 

Yes, this would be nice to know...

> having a control connection to negotiate these things?
> (something like 
> https://tools.ietf.org/id/draft-paasch-mptcp-control-stream-00.txt maybe?)

This should be entirely in kernel, as requiring a daemon to pass non-TCP
traffic before any encrypted TCP traffic can be sent it a bad idea...

-- 
  John-Mark Gurney				Voice: [phone]

     "All that I will do, has been done, All that I have, has not."