Subject: RE: [Seamoby] Issue3: Specifying IPsec between ARs

From: [email-masked]
Date: Fri, 27 Jun 2003 22:05:17 +0300

Hi Vijay,

> why is encryption necessary between the access routers? thats
> an overkill if you have to encrypt a huge CTP packet. isnt 
> authentication and integrity protection enough?

Required to implement, optional to use.
 
> the problem is we should not specify what should be used. we
> should specify what kind of protection is needed. and let
> the people who implement CTP negotiate AH or ESP between the 
> access routers.

If you think negotiation is better, then we need to have the
text to say how this is done.

John

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 27 Jun 2003 12:20:49 -0700

> text to say how this is done.

negotiation between the access router could be

1. run IKE. the security policy on the access routers would
   say  

   if protocol = CTP message (UDP with some additional info)
   and destination = another AR (or could be any)
   negotiate ESP in transport mode with a particular algorithm

   or it could say

   if protocol = CTP message (UDP with some additional info)
   negotiate AH in transport mode with HMAC_SHA1

2. manual keying between the access routers. this would need
   administrators to be involved. then the security policy 
   would say

   if protocol = CTP message (UDP with some additional info)
   use SA_something.

   the SA would have the appropriate information.

my point, there is nothing special that CTP requires of 
IPsec or IKE. there is no need to specify anything extra. 
and CTP shouldnt also care if IKE/IKEv2/manual keying is 
used. it shouldnt care which IPsec protocol (AH or ESP)
is used. it would be enough to simply say

  The Context Transfer Protocol messages between the Access 
  Routers require per-packet authentication and integrity 
  protection. Therefore IPsec MUST be used to protect the 
  Context Transfer Protocol messages between the Access 
  Routers.

Vijay