Subject: [Spud] Declarations: Authentication and encryption

From: Szilveszter Nadas <[email-masked]>
Date: Thu, 5 Mar 2015 16:55:49 +0000

Hi,

I am aware that security is not the main scope at the moment, but still I am interested about opinions about this.

The principle of declarations is to "trust but verify". I think still authentication can help this trust quite much. If the two points communicating have some relationship or history and have a proof about their identity a more "brave" trust can be the default behavior. Verification of declarations can still happen. Also authentication can be verified by the middlebox, even after choosing appropriate actions based on the content of the declarations so not delaying the flow and deceisons.

The other thing is that I see the privacy of both endhosts and of middleboxes important. Middleboxes might not want to allow others (e.g. other middleboxes) to collect data about their answers as these are partly consequences of business decisions. Endpoints might have similar concerns. Encryption can easily solve this.

In summary what do you think about authentication and encryption of declarations?

Cheers,
Szilveszter

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 5 Mar 2015 17:11:49 +0000

I think authentication is important to prevent MIM from modifying the SPUD packets. http://tools.ietf.org/html/draft-ietf-pcp-authentication-02 discusses authentication mechanism b/w the endpoint and PCP-aware firewall; the transport key derived from authentication can be used to generate authentication tag for the SPUD packet.

-Tiru

From: Spud [mailto:[email-masked]] On Behalf Of Szilveszter Nadas
Sent: Thursday, March 05, 2015 10:26 PM
To: [email-masked]
Subject: [Spud] Declarations: Authentication and encryption

Hi,

Cheers,
Szilveszter