Subject: [karp] KMP and IPSEC

From: shraddha <[email-masked]>
Date: Thu, 27 Jan 2011 14:52:58 +0530

Hi All,

I have recently joined the KARP mailing list and have gone through
The drafts and work in progress.

I could not understand the choice of new KMP framework for routing protocols
rather than using IPSEC

1. From some of the previous archives I could get information that the major
concern for not using IPSEC is the multicast traffic that needs to be
protected in routing protocols. 

2. There is significant work going on in MSEC group and the new drafts and
RFCs address securing multicast traffic along with dynamic keying.
RFC 5374 even addresses the anti-replay mechanisms to be followed for
multicast packets.

3. The KMP framework drafts also propose to use IKEv2 for dynamic key
negotiation. IKE and IPSEC always go together and there may be less
possibility of only IKE available on a router without IPSEC.

Since we already have a security framework in terms of IPSEC available,
which can mostly handle all the security requirements, is there a need to
come up with new key management framework for the routing protocols?. 

The new KMP also depends on IKE for the node authentication which has to be
either Pre-shared key or the PKI based authentication so all the issues
related to PSK  (less scalable and manageable) and PKI (high cost
infrastructure and third party software) remain open, which might have been
the reasons for the delayed deployment of IPSEC in the backbone networks.

The only advantage I can think of, for the separate KMP for routing
protocols is 
> The ease of controlling the SA granularity based on native protocol. 
> May be new KMP will reduce some small amount of memory overheads
  In terms of maintaining the SAs 

The above two advantages look negligible in terms of ROI of implementing new
framework.

Some one can suggest if my understandings are correct or I have missed
something.

Thanks
Shraddha

****************************************************************************
***********
This e-mail and attachments contain confidential information from HUAWEI,
which is intended only for the person or entity whose address is listed
above. Any use of the information contained herein in any way (including,
but not limited to, total or partial disclosure, reproduction, or
dissemination) by persons other than the intended recipient's) is
prohibited. If you receive this e-mail in error, please notify the sender by
phone or email immediately and delete it!

---

From: mark Brown <[email-masked]>
Date: Fri, 28 Jan 2011 05:57:29 +0530

Shraddha,

The WG has not yet concluded on whether it wants to define a new KMP
for routing protocols or wants to continue with using IPsec for the
same.

Mark

On Thu, Jan 27, 2011 at 2:52 PM, shraddha <[email-masked]> wrote:
> _______________________________________________
> karp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/karp
>