Subject: [seamoby] RE: Yet another Security RANT was L2 API (WAS: Ext. for FMIPv6 - comments) (SHOULD be , RE: Issue #4)

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Mon, 16 Jul 2001 16:12:14 -0500

Phil,

You and I and possibly a lot of people might all have our 2 cents
worth (no offense, just borrowing from your own signature below)
of comments, when it comes to security, but

I heard Jeff Schiller during his security tutorial say:
"Don't come to us with unsecure protocols and say this is
my protocol, if you need security, use IPSec. You need to secure
your protocols yourself."
He also said, "the security folks in security area say, why should
we drop everything and go analyze other people's security problems"

As much as most of us feel we don't know as much as we would like
about security, we need to deal with it ourself. You can expect
your neighbor to shovel your driveway, just because he has a expensive
blower. 

So bottom line, as much as we might hate it, we have to deal with
our own security problems.

Madjid

-----Original Message-----
From: Phillip Neumiller [mailto:[email-masked]]
Sent: Friday, July 13, 2001 8:23 AM
To: 'Nakhjiri Madjid-MNAKHJI1'; Phillip Neumiller; 'Pat Calhoun'
Cc: [email-masked]
Subject: Yet another Security RANT was L2 API (WAS: Ext. for FMIPv6 -
comments) (SHOULD be , RE: Issue #4)

Hi Madjid,

I disdain coupling security issues with non-security transport 
design and requirements formulation.  I believe security issues
should be left up to the security WG where the appropriate domain
experts can create general purpose solutions.  IP and the major
transport protocols such as UDP, TCP, and SCTP should be made
secure (perhaps with IPsec).  Users of these off-the-shelf 
protocols could then "feel" safe about doing what they want and
not waste time getting all balled up in security issues.  It
seems like a BAD idea to me to make every single IETF WG jump
through security hoops since:

A).  It dilutes the real "work" the WG is trying to do
B).  It allows for wasted effort on different security solutions
     all over the IETF since they are uncoordinated
C).  The members of many non-security WGs do not have the 
     appropriate domain expertise to solve security problems.

So clearly I disagree with our ADs on this issue.  Is that a 
crime?  This is not the first time (or the first WG) I have
stated this (in).

CASE IN POINT: Handovers.

Handovers can be done with MIP.  They can be done with "local-mobility"
protocols, or perhaps in other ways.  Security of the mobile host is
likely to be done differently by different network operators.  To explicitly
tie some mandated security to the our handover work weakens its 
general applicability.  However, I am all in favor of an
API/signaling/trigger
mechanism/hooks for security/AAA.  My two cents!

Thanks,

Phil

> -----Original Message-----
> From: Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
> Sent: Thursday, July 12, 2001 7:01 PM
> To: 'Phillip Neumiller'; 'Pat Calhoun'
> Cc: 'James Kempf'; [email-masked]; Nakhjiri
> Madjid-MNAKHJI1; [email-masked]; [email-masked]
> Subject: RE: [seamoby] L2 API (WAS: Ext. for FMIPv6 - 
> comments) (SHOULD
> be , RE: Issue #4)
> 
> 
> <snip/snap>
> 
> >CT should be used for volatile handover related data nothing 
> more.  If
> >you want to piggy back a bunch of security crap on it that's 
> a BAD idea.
> 
> Phil, Have you tried the unsecure HO idea with the ADs ??
> 
> :)
> Madjid
>

---

From: Phillip Neumiller <[email-masked]>
Date: Mon, 16 Jul 2001 17:35:09 -0400

Snow blowing my driveway is one thing.  They are asking us to plow
a path to the grocery store!  That I pay taxes for!  In the IETF
the equivalent is the existence of the Security WG and its 
contribution to the Internet as a whole.  So I guess I differ from
you here.  C u in London.  

> Sent: Monday, July 16, 2001 5:12 PM
> To: 'Phillip Neumiller'; Nakhjiri Madjid-MNAKHJI1; 'Pat Calhoun'
> Subject: RE: Yet another Security RANT was L2 API (WAS: Ext. 
> for FMIPv6
> - comments) (SHOULD be , RE: Issue #4)
> 
> 
> Phil,
>

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Mon, 16 Jul 2001 17:11:28 -0500

Ok, Phil, I guess I haven't been with IETF long enough :)
you need to explain the grocery store part for me in London.

Madjid