Subject: RE: Should IP Security be Optional? [Was RE: draft-ietf-ipv6-cel lular-host-00.txt -> wg last call?]

From: "Karim El-Malki (ERA)" <[email-masked]>
Date: Thu, 7 Mar 2002 12:39:07 +0100

> On Wed, Mar 06, 2002 at 11:52:15AM -0500, Bound, Jim wrote:
 > > Margaret,
 > > 
 > > What is required for a full implementation for IPv6 by the 
 > standards is
 > > set in stone. Vendors that don't adhere to this are 
 > risking to much.
 > > What they deploy and what standards is different issue.  
 > > 
 > > I can have IPsec (and do) in a product source pool and in 
 > the product.
 > > But I will give users the ability to disable it if they 
 > want to not take
 > > the performance hit and deal with the security risk.
 > 
 > ... and the interoperability problem ... are they aware of that?
 > 
 > I can understand people want to disable DAD for very 
 > specialized links, but...
 > IPSec is no link layer feature, it is a (mostly-)END to END 
 > feature (where
 > END might be your trusted border router).

You want to support IPsec and that's fine. However I don't
think you always want to run IPsec when the result is for
example a possible higher packet loss rate. That depends on the cellular
link where IP headers are compressed (see ROHC WG). Smaller packets have
a lower probability of errors over the air. If you encrypt using IPsec
you can't compress headers as well any more. So the implementer/user must
be aware of this link specific issue which may affect IPsec traffic.
In that case he may very well want to disable IPsec and deal with it.

/Karim
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Robert Elz <[email-masked]>
Date: Thu, 07 Mar 2002 19:22:03 +0700

Date:        Thu, 7 Mar 2002 12:39:07 +0100 
    From:        "Karim El-Malki (ERA)" <[email-masked]>
    Message-ID:  <795A014AF92DD21182AF0008C7A404320DFBEFEB@esealnt117>

  | You want to support IPsec and that's fine. However I don't
  | think you always want to run IPsec when the result is for
  | example a possible higher packet loss rate.

No, of course you don't always want to run it.   Why you you think
that anyone always wants to run it?   But when you need IPsec, you
need it - and that you happen to be using a cellular link for some
particular communications is irrelevant.   Whether to use IPsec or
not will depend upon the particular communications at any particular
instant, and needs to be able to be determined by the user - certainly
never by the implementor, who has no idea what environment (which includes
the remote end of communications) the equipment will be used in.

kre