Subject: RE: [L2tpext] draft-ietf-l2tpext-l2tp-atm-02.txt

From: Singh Ajoy-ASINGH1 <[email-masked]>
Date: Thu, 25 Apr 2002 15:36:45 -0500

Hello Thomas,
Sorry for late reply. Since I have not been actively 
involved in L2TP work any more. But I am willing 
to make necessary changes in security section and 
submmit the draft. Please see my inline 
reply.
regards,
ajoy

-----Original Message-----
From: Thomas Narten [mailto:[email-masked]]
Sent: Tuesday, April 23, 2002 2:39 PM
To: [email-masked]
Subject: [L2tpext] draft-ietf-l2tpext-l2tp-atm-02.txt

Some IESG comments on the security considerations section.

reviewer 1
> note:
>         this has the same problem as PPP over AAL2
>         the security section makes an unreasonable assumption on
>         ATM security

Reviewer 2:
> >9. Security Considerations
> >
> >   ATM networks, being virtual circuit based, are generally less
> >   vulnerable to security attacks than IP based networks.  The
> >   probability of a security breach caused by misrouted ATM cells is
> >   considered to be negligible.
> 
> As in the case of PPP over AAL5, this is making an assumption about
> who and how the ATM network is being operated and as such is
> inappropriate in a standards document. I would recommend striking this
> paragraph completely.
> 
> >   Currently there is no standard specification for ATM security.
> >   However, the ATM Forum is working on an ATM Security Framework
> >   document.  In light of this work, the issue of security will be re-
> >   examined at a later date to see if L2TP over ATM specific protection
> >   mechanisms are still required.  In the interim, basic security issues
> >   are discussed in the base L2TP specification [RFC2661].
> 
> I believe this paragraph is fine.

Actually, maybe the above isn't really fine afterall. Note that
draft-ietf-pppext-ppp-over-aal2-03.txt was recently updated with the
following text:

> System security may also be compromised by the attacks of the ATM
> transport network itself. The ATM Forum has published a security
> framework [11] and a security specification [12] that define
> procedures to guard against common threats to an ATM transport
> network.

So, is it really the case to say that ATM has no security?
Ajoy: Is it enough to update security section to be consistent with 
PPP over AAL2 draft ? The initial security section was 
written two years back probably lot of things have changed 
since then. 

Thomas

_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext

_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext