Subject: [bmwg] possible additional term for draft-ietf-bmwg-ipsec-term-05.txt

From: David Newman <[email-masked]>
Date: Wed, 22 Jun 2005 10:34:27 -0700 (PDT)

One other issue with the ipsec draft is the auspices under which tunnel 
capacity tests are done. Many tunnel capacity tests are conducted using 
pre-shared keys only.

In production settings, many (most?) service providers and enterprises use 
stronger authentication measures such as XAUTH or XAUTH plus certs. Either 
of these have significant computation costs and thus may well affect 
tunnel capacity test results.

While this is mostly a methodology issue, there is no discussion of XAUTH 
in the terminology draft. Certs are covered in the IKE discussion.

dn

_______________________________________________
bmwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/bmwg

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 22 Jun 2005 13:10:47 -0700

At 10:34 AM -0700 6/22/05, David Newman wrote:
>In production settings, many (most?) service providers and 
>enterprises use stronger authentication measures such as XAUTH or 
>XAUTH plus certs.

<sound of klaxon blaring>

- XAUTH is not necessarily stronger authentication than preshared secrets.

- XAUTH is not (and probably never will be) an IETF standard.

- XAUTH changed from version to version of the drafts, and there is 
little interoperability between vendors.

- Certificate authentication is poorly deployed and the interop is very low.

- You don't need XAUTH to use certs.

>Either of these have significant computation costs and thus may well 
>affect tunnel capacity test results.

Fully agree. XAUTH causes extra round trips. Cert authentication, if 
done without hardware acceleration, is computationally expensive.

>While this is mostly a methodology issue, there is no discussion of 
>XAUTH in the terminology draft. Certs are covered in the IKE 
>discussion.

I think that XAUTH cannot be discussed because it is not a standard. 
There are are lots of unbaked remote-access solutions that didn't 
move forwards for IPsec (and I say that as the co-chair of a working 
group that had one near completion before we gave up due to lack of 
interest).

--Paul Hoffman, Director
--VPN Consortium

---

From: David Newman <[email-masked]>
Date: Wed, 22 Jun 2005 13:31:39 -0700 (PDT)

On Wed, 22 Jun 2005, Paul Hoffman wrote:

<many valid complaints about XAUTH deleted>

> I think that XAUTH cannot be discussed because it is not a standard. There 
> are are lots of unbaked remote-access solutions that didn't move forwards for 
> IPsec (and I say that as the co-chair of a working group that had one near 
> completion before we gave up due to lack of interest).

Fair point, and frankly not one I'd considered. In its defense, XAUTH 
(unlike CAs) is not "poorly deployed." Its use is fairly widespread both 
among service providers and enterprises.

My concern, and this is really for the methodology doc, is that we end up 
with a tunnel capacity test using pre-shared keys only, thus allowing 
meaningless claims of support for umpity-poo tunnels when in production 
settings users get just a fraction of umpity-poo because XAUTH and/or 
certs come into play.

dn