IETF Logo Mail Archive

RE: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03

Rémi Denis-Courmont <rdenis@simphalempin.com> Wed, 27 August 2008 12:23 UTC

Return-Path: <owner-v6ops@ops.ietf.org>
X-Original-To: ietfarch-v6ops-archive@core3.amsl.com
Delivered-To: ietfarch-v6ops-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8D9643A6923 for <ietfarch-v6ops-archive@core3.amsl.com>; Wed, 27 Aug 2008 05:23:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.371
X-Spam-Level:
X-Spam-Status: No, score=-101.371 tagged_above=-999 required=5 tests=[AWL=0.929, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N86kAkMxsuQS for <ietfarch-v6ops-archive@core3.amsl.com>; Wed, 27 Aug 2008 05:23:40 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AEA1C3A6884 for <v6ops-archive@lists.ietf.org>; Wed, 27 Aug 2008 05:23:40 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-v6ops@ops.ietf.org>) id 1KYK1g-000MLz-H5 for v6ops-data@psg.com; Wed, 27 Aug 2008 12:21:28 +0000
Received: from [2001:41d0:1:a0d6::401:1983] (helo=yop.chewa.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from <rdenis@simphalempin.com>) id 1KYK1c-000MLX-52 for v6ops@ops.ietf.org; Wed, 27 Aug 2008 12:21:25 +0000
Received: by yop.chewa.net (Postfix, from userid 33) id 507EACC9; Wed, 27 Aug 2008 14:21:23 +0200 (CEST)
To: v6ops@ops.ietf.org
Subject: RE: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03
MIME-Version: 1.0
Date: Wed, 27 Aug 2008 14:21:23 +0200
From: Rémi Denis-Courmont <rdenis@simphalempin.com>
Organization: Remlab.net
In-Reply-To: <DC237AE116C10E4C9AD162D6C2EE62FE0106AF6D@vaebe102.NOE.Nokia.com>
References: <20080824204553.08131c65.ipng@69706e6720323030352d30312d31340a.nosense.org> <48B1CCE8.1070305@gmail.com> <01af01c9065b$b4602440$c2f0200a@cisco.com> <48B23391.1090503@gmail.com> <01cd01c90672$a57c8790$c2f0200a@cisco.com> <48B31DA3.6080001@gmail.com> <07d201c906f7$50a85e30$c2f0200a@cisco.com> <48B32B43.5010103@gmail.com> <084c01c906fe$f9bf1840$c2f0200a@cisco.com> <48B33430.40704@gmail.com> <08b901c90710$4064aa60$c2f0200a@cisco.com> <48B354FA.7040601@gmail.com> <48B50B10.9090005@free.fr> <f0913a34d402b6a4d25787bab3eea17b@chewa.net> <DC237AE116C10E4C9AD162D6C2EE62FE0106AF6D@vaebe102.NOE.Nokia.com>
Message-ID: <d56f5f2a1371af12b7a45f1ec197e4bd@chewa.net>
X-Sender: rdenis@simphalempin.com
User-Agent: RoundCube Webmail/0.1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk
List-ID: <v6ops.ops.ietf.org>

On Wed, 27 Aug 2008 13:46:34 +0300, <teemu.savolainen@nokia.com> wrote:

> In cellular environments filtering of the downlink carbage to increase

> battery lifetime of handhelds is an important function.



> However, if the firewall is there to save batteries and not to enforce

any

> special policies, it might be more willing to be controlled?



Hmm, that's right. I assume in most cases, statefull firewall is used

however, with its advantage (it does not need any new signaling protocol)

and its well-known limitations.



I just fear that "cross-domain" control brings intractable security vs

deployment constraints onto the control protocol. I hope we can stick to

simple return-routability checks for ALD or whatever it turns into. If you

ask me, this protocol is dead on arrival if it requires x509 or another

strong authentication mechanism, that breaks the "zeroconf" property of ALD

as it currently is specified.



-- 

Rémi Denis-Courmont

v2.23.0 | Report a Bug | By Email