RE: [tcpm] tcpsecure: how strong to recommend?

["Anantha Ramaiah \(ananth\)" <[e-mail]>]

Few points :-

- It is true that TCP secure recommendations might be useful for long
lived sessions like BGP. But there are many applications using TCP which
also could benefit from the proposed changes. The TCP secure changes
needs to be viewed as a standalone thing, since it focusses in providing
robustness to TCP connections w.r.t some spoofing attacks. 

- TCP secure changes are not going to solve the "world hunger problem".
Ipsec and TCP secure are completely orthogonal since Ipsec is generic
security solution with it's own pros and cons whereas TCP secure
attempts to illustrate some known issues w.r.t some TCP spoofing attacks
and proposes mitigations to the same.

- The WG is also talking about replacing the TCP MD5 with a more generic
TCP security algorithms. This came out of the need to provide security
at layer 4. I know some people would dis-agree but that is a different
story.

- TCP secure, TCP MD5, TCP advanced security algorithms, IPsec are all
different tools with varying degrees of complexity and usage. A user can
chose to use one of them depending on his/her requirements. Telling
people to only use IPsec is akin to saying "always fly in business
class". Yes I have used this analogy before, but this is one whih popped
up in mind after today's coffee :-)

So, I would not draw some comparisions between TCP secure and other
"security" solutions including BTNS etc., These need to be viewed upon
independently.

Well, I am speaking out of experience resulting from dealing with
working on many products which use TCP and confronting the differing
requirements imposed by those, so needless to say, OMMV.

-Anantha

> 
> > > How's BTNS coming along?   Will we be seeing BGP over 
> BTNS anytime soon?
> > > (I've not been following BTNS too closely recently).
> > 
> > See the Goals and Milestones at:
> > http://www.ietf.org/html.charters/btns-charter.html
> 
> 
> Cool.  But that is only a (partial) answer to my first 
> question.  From the status of Goals and Milestones on that 
> IETF WG charter page, I cannot tell if the result of the BTNS 
> WG is something that is sufficiently far along that "go do 
> BTNS" is a viable alternative to this "tcpsecure" draft.  
> Presumably I could read all the drafts that are there and 
> form my own opnion, but the queue of things that I ought to 
> read soon is much deeper than what I will be able to read soon.
> 
> (For those attempting to follow along... I believe the need 
> that  triggered this tcpsecure draft was also (one of?) the 
> trigger(s) that
>  led to the BTNS WG effort.    This tcpsecure draft is a collection of
>  hacks (which appear to solve the problems as we understand 
> them now)  while the BTNS effort was started in an attempt to 
> solve the problem  in an architecturally correct and more robust way.)
> 
> At some point there's a decision to be made, recommend what's 
> in the tcpsecure draft, or recommend what BTNS has produced.
> 
> So I ask: is BTNS succeeding such that it is a viable 
> alternative to this tcpsecure draft?
> 
> 			-Tim Shepard
> 			 [e-mail]
> 
> _______________________________________________
> tcpm mailing list
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/tcpm
> 

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm