Subject: [seamoby] Yet another Security RANT was L2 API (WAS: Ext. for FMIPv6 - com ments) (SHOULD be , RE: Issue #4)

From: Phillip Neumiller <[email-masked]>
Date: Fri, 13 Jul 2001 09:22:52 -0400

Hi Madjid,

I disdain coupling security issues with non-security transport 
design and requirements formulation.  I believe security issues
should be left up to the security WG where the appropriate domain
experts can create general purpose solutions.  IP and the major
transport protocols such as UDP, TCP, and SCTP should be made
secure (perhaps with IPsec).  Users of these off-the-shelf 
protocols could then "feel" safe about doing what they want and
not waste time getting all balled up in security issues.  It
seems like a BAD idea to me to make every single IETF WG jump
through security hoops since:

A).  It dilutes the real "work" the WG is trying to do
B).  It allows for wasted effort on different security solutions
     all over the IETF since they are uncoordinated
C).  The members of many non-security WGs do not have the 
     appropriate domain expertise to solve security problems.

So clearly I disagree with our ADs on this issue.  Is that a 
crime?  This is not the first time (or the first WG) I have
stated this (in).

CASE IN POINT: Handovers.

Handovers can be done with MIP.  They can be done with "local-mobility"
protocols, or perhaps in other ways.  Security of the mobile host is
likely to be done differently by different network operators.  To explicitly
tie some mandated security to the our handover work weakens its 
general applicability.  However, I am all in favor of an
API/signaling/trigger
mechanism/hooks for security/AAA.  My two cents!

Thanks,

Phil

> -----Original Message-----
> From: Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
> Sent: Thursday, July 12, 2001 7:01 PM
> To: 'Phillip Neumiller'; 'Pat Calhoun'
> Cc: 'James Kempf'; [email-masked]; Nakhjiri
> Madjid-MNAKHJI1; [email-masked]; [email-masked]
> Subject: RE: [seamoby] L2 API (WAS: Ext. for FMIPv6 - 
> comments) (SHOULD
> be , RE: Issue #4)
> 
> 
> <snip/snap>
> 
> >CT should be used for volatile handover related data nothing 
> more.  If
> >you want to piggy back a bunch of security crap on it that's 
> a BAD idea.
> 
> Phil, Have you tried the unsecure HO idea with the ADs ??
> 
> :)
> Madjid
>

---

From: Pat Calhoun <[email-masked]>
Date: Fri, 13 Jul 2001 10:24:41 -0700

What you describe below is how things should work in the idea world.
However, given that we aren't there, we have to live with existing
processes.

The way the process works, generally, is that a WG defines its
security requirements, and attempts to solve the problem. The
WG is highly encouraged to get folks that understand security
involved, and this can be done by asking the Security ADs for
some assitance. I've worked in some WGs where we requested
security review early on, and received great input.

The main reason why it works this way is that another WG typically
doesn't understand our problem space, and could propose a solution
that isn't feasible, but secure.

As far as disagreeing with IESG, there is no crime in that. In fact,
disagreeing, and raising issues, can sometimes lead to better results.

PatC