Subject: PPP encryption documents

From: Thomas Narten <[email-masked]>
Date: Wed, 24 Jun 1998 15:38:16 -0400

The IESG recently discussed the following 2 PPP encryption documents:

    draft-ietf-pppext-3des-encrypt-00.txt
    draft-ietf-pppext-des-encrypt-v2-02.txt

The two documents are up for consideration as Proposed Standards.

During the IESG discussions, we observed that the two PPP encryption
drafts only do encryption, and do not include any authentication. The
IPSec folks were convinced a while back that encryption without
authentication (i.e., integrity protection) is a Bad Thing.
Consequently IPSec's ESP transform now includes an authentication MAC.
At the very least, this should be mentioned in the Security
Considerations section the two PPP documents.

Beyond that, what the PPP group wants to do requires discussion. I
suspect that the WG may want to publish one or both drafts anyway
(i.e., with no on-the-wire protocol change) as at least for the single
DES draft, this document updates an RFC that presumably has seen
deployment. An important piece of data here is how much deployment the
existing single DES RFC has seen.

The WG may also decide that its worth defining a stronger transform
that does both encryption/authentication. This could be a follow-on
work item independent of the existing documents, or a replacement of
the above drafts. If this route is chosen, some thought should be
given to what the status of the documents should be. I.e, if a new,
better transform is to be defined, perhaps the current drafts should
be marked informational (gee, isn't that where we started?) with the
new transform being the one to go on standards track.

It is probably also worth noting that the use/deployment of L2TP
tunnels may increase the desirability of having a per-packet PPP
authentication capability, something that is missing now (one can
authenticate the creation of a session, but not each individual packet
of the session).

Comments?

Thomas

---

From: John Shriver <[email-masked]>
Date: Wed, 24 Jun 1998 17:16:17 -0400

Yes, the ECP transforms don't include anti-replay protection, etc.
(Vern, I beleive Steve Bellovin has written good stuff on why IPSec's
ESP needs packet integrity checks and anti-replay checks.  Same would
apply to PPP.)  But, I think that those needs are best met by IPSec in
this day and age.

I think that the L2TP people are looking at IPSec in general, since
they need to secure what's under PPP, not what's over it.

I think the security working group isn't interested in PPP
re-inventing IPSec.