Subject: Re: [RPSEC] Draft Status....

From: Jeffrey Haas <[email-masked]>
Date: Mon, 5 Aug 2002 13:56:56 -0400

On Tue, Jul 23, 2002 at 09:14:44PM -0400, Stephen Kent wrote:
> If we assume that man-in-the-middle attacks are a valid concern, then 
> the details of the underlying transport protocol probably do not 
> matter much, since we will require a crypto-security mechanism to 
> protect the traffic. It also is appropriate to document the ways in 
> which a routing protocol relies on the underlying transport protocol.
> 
> I don't think that documenting vulnerabilities of otherwise 
> unprotected transport protocols is the best strategy for our work.

As I had mentioned earlier, I would agree with this assessment.
Secure the transport layer, document the dependencies of a given
protcol on a given transport and then work on securing the protocol's
actual payload.

BGP currently has documents talking about securing it via TCP+MD5
and also via IPSec.  What about the other protocols?

Is someone willing to gather a list of the protocols we are concerned
with and document their transport security issues?

> Steve

-- 
Jeff Haas 
NextHop Technologies

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec