Subject: RE: [Ieprep] TCP PEPs and Priority-based Mechanisms

From: "King, Kimberly S." <[email-masked]>
Date: Mon, 22 Dec 2003 14:16:48 -0500

> The use of Performance Enhancing Proxies introduces several issues
>    which impact security. 

Yes, you are right to point that out but unfortunately that's just the way
it is.  Even if we forget about PEPs for the moment.  

Use IPsec but mark the packets using DSCPs kept in the clear.  Consider
traffic analysis...sit back and watch the codepoints (lots of high priority
MLEF?)

"
* Security UP => Bandwidth Utilization DOWN
* Security UP => Performance DOWN
* Tunnels Tunnels Tunnels and more Tunnels
* Performance DOWN => Security DOWN
=>  User turns OFF Security to make system usable!
* Thus, we need more bandwidth to ensure security.
"
http://spacecom.grc.nasa.gov/icnsconf/docs/2002/10/Session_E1-5_Ivancic.pdf

I think one makes the choices that best fit because there is no free lunch.
:-(

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: Rex Buddenberg <[email-masked]>
Date: 22 Dec 2003 11:50:41 -0800

Kimberly,

Actually you hit the one compelling reason, IMHO, for shifting to IPv6. 
Note that I'm here at the network layer, not transport.  IPv6 supports
header extensions -- the extension+payload get encrypted but the base
header (which includes DSCP) does not.  So any network level QoS you
choose to use is unaffected by IPSec.

Back at the transport layer, I'm just not terribly turned on by PEPs. 
The RFC is useful because it surveys a fairly wide set of bandaids that
fall under the general PEP category.   But these remain bandaids until
we grapple with the nextgen transport protocol issue.

-- 
b