Subject: RE: [Seamoby] Issue3: Specifying IPsec between ARs

From: [email-masked]
Date: Sat, 28 Jun 2003 08:20:33 +0300

Hi all,

So, thus far we have:

2 people saying (Basavaraj & Vija): 

 my point, there is nothing special that CTP requires of 
 IPsec or IKE. there is no need to specify anything extra. 
 and CTP shouldnt also care if IKE/IKEv2/manual keying is 
 used. it shouldnt care which IPsec protocol (AH or ESP)
 is used. 

Antti Tuomin says:

   Section 2. paragraph 3 says: "CT peers to utilize a secure channel
   for transferring contexts, providing authentication, integrity, and
   (if needed) confidentiality."  Subsection 2.4.2 and 2.4.3 say
   "message SHOULD be protected by use of IPsec Authentication Header
   (AH)".  Couldn't you just use ESP?  AH alone is not able to give
   confidentiality mentioned earlier.  Is there a specific reason to
   use AH (like need for IP header authentication)?  Also, Mobile IPv6
   uses ESP, so the chances are that ESP is already implemented in all
   the entities.

Hesham says, in answer to the question", Do folks think that mandatory IPsec 
is reasonable here?"

 Yes. And you need to specify how to do that. I 
 mean, a side effect of this would be that all UDP traffic 
 will be secure (from a quick read I saw that UDP is the 
 transport protocol for CTP).

Pekka Savola says:

 So, the model how security is used must be re-thought.  It would seem to
 be the safest to say that AH (or maybe ESP, dunno) *MUST* be used for all
 message types, and describe different issues there.  In some cases where
 context transfers messages are only received from pAR's/nAR's in the same
 security domain (e.g. single ISP), over a sufficiently secure medium, even
 lower requirements might be reasonable.

So, I cannot say we have consensus on this subject.  However, in absence
of compelling info, I tend to be conservative on security issues.

John
> -----Original Message-----
> From: ext [email-masked] [mailto:[email-masked]]
> Sent: 27 June, 2003 23:37
> To: [email-masked]; Loughney John (NRC/Helsinki)
> Cc: [email-masked]
> Subject: RE: [Seamoby] Issue3: Specifying IPsec between ARs
> 
> 
> 
> > negotiation between the access router could be
> > 
> > 1. run IKE. the security policy on the access routers would
> >    say  
> > 
> >    if protocol = CTP message (UDP with some additional info)
> >    and destination = another AR (or could be any)
> >    negotiate ESP in transport mode with a particular algorithm
> > 
> >    or it could say
> > 
> >    if protocol = CTP message (UDP with some additional info)
> >    negotiate AH in transport mode with HMAC_SHA1
> >  
> > 
> > 2. manual keying between the access routers. this would need
> >    administrators to be involved. then the security policy 
> >    would say
> > 
> >    if protocol = CTP message (UDP with some additional info)
> >    use SA_something.
> > 
> >    the SA would have the appropriate information.
> > 
> > my point, there is nothing special that CTP requires of 
> > IPsec or IKE. there is no need to specify anything extra. 
> > and CTP shouldnt also care if IKE/IKEv2/manual keying is 
> > used. it shouldnt care which IPsec protocol (AH or ESP)
> > is used. it would be enough to simply say
> > 
> >   The Context Transfer Protocol messages between the Access 
> >   Routers require per-packet authentication and integrity 
> >   protection. Therefore IPsec MUST be used to protect the 
> >   Context Transfer Protocol messages between the Access 
> >   Routers.
> > 
> 
> I agree with what Vijay is saying here. It is sufficient to
> specify that IPsec be used for securing CTP messages between
> ARs.
> 
> > Vijay
> > 
> 
> -Basavaraj
> 
> _______________________________________________
> Seamoby mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/seamoby
> 

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: Vijay Devarapalli <[email-masked]>
Date: Sun, 29 Jun 2003 22:46:15 -0700

[email-masked] wrote:

> In some cases where

this is a very good comment, John. it makes no sense making the
use of ESP mandatory, especially in the above scenario. you have
to atleast say, if you already have a secure channel, IPsec must
be optional..

> of compelling info, I tend to be conservative on security issues.

all right, then. I guess it is better to be conservative. but
remember people are going to ignore the MUST use ESP requirement
if they already have a secure channel between the access routers.

Vijay

---

From: "James Kempf" <[email-masked]>
Date: Mon, 30 Jun 2003 14:15:02 -0700

John,

I think all the draft needs to say is that:
 - IPsec must be used to protect interrouter traffic, for both
confidentiality and authenticaton, if security is required.
 - whether AH/ESP authentication or ESP encryption is used depends on the
particular deployment situation and threat (i.e. if any traffic traverses
the Internet for whatever reason, then ESP encryption should be used).
I don't think that the draft should let it open as to the security method if
security is required. Of course, it is up to the network operator whether or
not they want to deploy security.

            jak

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 30 Jun 2003 14:36:00 -0700

Hello Jim,

This makes a lot of sense to me.

Regards,
Charlie P.