Re: [Tsvwg] Adopting draft-behringer-tsvwg-rsvp-security-groupkeying as WG item?

[RJ Atkinson <[e-mail]>]

On  28 Jan 2008, at 05:26, Lars Eggert wrote:
> For which current work item in TSVWG would group keying be useful,  
> or rather, required? A need for a new solution needs to come from an  
> application that requires group keying. As far as I know, no such  
> application is being worked on in TSVWG.

Group keying for RSVP is needed for EVERY existing and planned
deployment of RSVP.  Deploying RSVP without authentication is
operationally extremely risky and vulnerable -- and always has been.

So I'd say that *every* application needs it.

> So this argues for extracting the repeated argument into an
> individual draft, so it can be referenced instead of needing
> to be duplicated. But it does not motivate the need for a new
> solution.

I would prefer that the IETF not play Ostrich (a desert bird
that when attacked sticks its head under the sand rather
than fleeing the attacker).  Simply documenting that any use
of RSVP is a huge security risk seems insufficient when
practical approaches to reducing that risk appear to exist.

RSVP is completely insecure at present.  We do NOT have any
solution for key management of RSVP.  Now, we do have an
opportunity here to significantly reduce the security risks
of using RSVP by enabling a first practical approach to RSVP
key management to be created.

That alone ought to be plenty of motivation.

Yours,

Ran
[e-mail]