Subject: Re: [Seamoby] Issue3: Specifying IPsec between ARs

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 27 Jun 2003 11:55:38 -0700

hi John,

why is encryption necessary between the access routers? thats
an overkill if you have to encrypt a huge CTP packet. isnt 
authentication and integrity protection enough?

the problem is we should not specify what should be used. we
should specify what kind of protection is needed. and let
the people who implement CTP negotiate AH or ESP between the 
access routers.

Vijay

[email-masked] wrote:
> 
> Hi all,
> 
> In order to close this issue, I have added the following text.
> 
> John
> 
> 6.1. IPsec Considerations
> 
> Access Routers MUST implement IPsec ESP [ESP] in transport mode with non-null encryption and authentication algorithms to provide per-packet authentication, integrity protection and confidentiality, and MUST implement the replay protection mechanisms of IPsec. In those scenarios where IP layer protection is needed, ESP in tunnel mode SHOULD be used. Non-null encryption should be used when using IPSec ESP.

it would be better to say, 

The Context Transfer Protocol messages between the Access 
Rotuers require per-packet authentication and integrity 
protection. Therefore IPsec MUST be used to protect the 
Context Transfer Protocol messages between the Access 
Routers.

(we dont have to say MUST implement replay protection. 
that comes automatically when IPsec and IKE are used).

Vijay

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: [email-masked]
Date: Fri, 27 Jun 2003 15:37:29 -0500

> negotiation between the access router could be
> 
> 1. run IKE. the security policy on the access routers would
>    say  
> 
>    if protocol = CTP message (UDP with some additional info)
>    and destination = another AR (or could be any)
>    negotiate ESP in transport mode with a particular algorithm
> 
>    or it could say
> 
>    if protocol = CTP message (UDP with some additional info)
>    negotiate AH in transport mode with HMAC_SHA1
>  
> 
> 2. manual keying between the access routers. this would need
>    administrators to be involved. then the security policy 
>    would say
> 
>    if protocol = CTP message (UDP with some additional info)
>    use SA_something.
> 
>    the SA would have the appropriate information.
> 
> my point, there is nothing special that CTP requires of 
> IPsec or IKE. there is no need to specify anything extra. 
> and CTP shouldnt also care if IKE/IKEv2/manual keying is 
> used. it shouldnt care which IPsec protocol (AH or ESP)
> is used. it would be enough to simply say
> 
>   Routers require per-packet authentication and integrity 

I agree with what Vijay is saying here. It is sufficient to
specify that IPsec be used for securing CTP messages between
ARs.

> Vijay

-Basavaraj

---

From: Soliman Hesham <[email-masked]>
Date: Sat, 28 Jun 2003 01:45:46 -0400

John, 

CTP should definitely care whether 
AH or ESP is used, depending on the context
being transfered. For instance, if the device's
encryption keys are being transferred from one 
AR to another you want integrity and confidentiality.
Therefore, you don't want AH only.

I think in most cases that I'm aware of it is sufficient
to use ESP. 

None of this means that CTP should be modified, it 
just means that the right requirement on the _use_
of IPsec should be made.

Hesham

 > -----Original Message-----
 > From: [email-masked] [mailto:[email-masked]]
 > Sent: Saturday, June 28, 2003 1:21 AM
 > To: [email-masked]; [email-masked]
 > Cc: [email-masked]
 > Subject: RE: [Seamoby] Issue3: Specifying IPsec between ARs
 > 
 > 
 > Hi all,
 > 
 > So, thus far we have:
 > 
 > 2 people saying (Basavaraj & Vija): 
 > 
 >  is used. 
 > Antti Tuomin says:
 >    Section 2. paragraph 3 says: "CT peers to utilize a secure channel
 >    for transferring contexts, providing authentication, 
 > integrity, and
 >    (if needed) confidentiality."  Subsection 2.4.2 and 2.4.3 say
 >    "message SHOULD be protected by use of IPsec Authentication Header
 >    (AH)".  Couldn't you just use ESP?  AH alone is not able to give
 >    confidentiality mentioned earlier.  Is there a specific reason to
 >    use AH (like need for IP header authentication)?  Also, 
 > Mobile IPv6
 >    uses ESP, so the chances are that ESP is already 
 > implemented in all
 >    the entities.
 > 
 > Hesham says, in answer to the question", Do folks think that 
 > mandatory IPsec 
 > is reasonable here?"
 > 
 >  Yes. And you need to specify how to do that. I 
 >  mean, a side effect of this would be that all UDP traffic 
 >  will be secure (from a quick read I saw that UDP is the 
 >  transport protocol for CTP).
 > 
 > Pekka Savola says:
 > 
 >  So, the model how security is used must be re-thought.  It 
 > would seem to
 >  be the safest to say that AH (or maybe ESP, dunno) *MUST* 
 > be used for all
 >  message types, and describe different issues there.  In 
 > some cases where
 >  context transfers messages are only received from 
 > pAR's/nAR's in the same
 >  security domain (e.g. single ISP), over a sufficiently 
 > secure medium, even
 >  lower requirements might be reasonable.
 > 
 > So, I cannot say we have consensus on this subject.  
 > However, in absence
 > of compelling info, I tend to be conservative on security issues.
 > 
 > John
 > > -----Original Message-----
 > > From: ext [email-masked] 
 > [mailto:[email-masked]]
 > > Sent: 27 June, 2003 23:37
 > > To: [email-masked]; Loughney John (NRC/Helsinki)
 > > Cc: [email-masked]
 > > Subject: RE: [Seamoby] Issue3: Specifying IPsec between ARs
 > > 
 > > 
 > >

---

From: [email-masked]
Date: Mon, 30 Jun 2003 19:46:53 +0300

Hi Vijay,

I did read Pekka's mail - I was actually hoping to know more about
this.  This isn't required for updating the draft, but for my
own knowledge.

thanks,
John

> From: Vijay Devarapalli [mailto:[email-masked]]
> Sent: 30 June, 2003 19:41
> To: Loughney John (NRC/Helsinki)
> Cc: Patil Basavaraj (NET/Dallas); [email-masked]
> Subject: Re: [Seamoby] Issue3: Specifying IPsec between ARs
> 
> 
> > Vija,
> > > all right, then. I guess it is better to be conservative. but
> > > remember people are going to ignore the MUST use ESP requirement
> > > if they already have a secure channel between the access routers.
> > 
> > What other secure channel do you mean? AH doesn't protect message
> > contents, which may be needed if you are transfering AAA or
> > keying material.  TLS is not possible, because we are using UDP.
> 
> for e.g.
> 
> > Pekka Savola says:
> > 
> > In some cases where