Subject: propose change to address multicast security issue

From: "Yang, Lily L" <[email-masked]>
Date: Wed, 27 Aug 2003 19:58:13 -0700

To address the issue over multicast security, I propose the following changes to framework section 7.2.3: 

[old 3rd paragraph]
"IPsec can support both unicast and multicast transport. When 
    multicast is used, IPsec can be used with manual keying with no 
    replay protection and no automatic rekeying.  This meets  the 
    confidentiality and integrity requirements.  Multicast-based 
    solutions relying on IPsec should specify how rekeying and replay 
    protection are provided.  "

[ new text ] 
 "IPsec can support both unicast and multicast transport. However, RFC 2401 [14] acknowledged that it did not specify complete support for IP multicast. At the time this document was published, MSEC working group is actively working on standardizing protocols to provide multicast security [17]. Multicast-based solutions relying on IPsec should specify how to meet the security requirements in [3].  "

Adding the following to Section 9: Informative References:
[17] Hardjono, T. and Weis, B. "The Multicast Security Architecture", work in progress, August 2003, <draft-ietf-msec-arch-03.txt>.

I would like the two of you and the WG review this. If satisfactory, I would roll all the recent changes per discussion on the list into v09 and ask for IESG review on it.

Thanks,

Lily

---

From: Jamal Hadi Salim <[email-masked]>
Date: Thu, 28 Aug 2003 04:09:17 -0700

Hi Lilly,

Sorry - meant to respond to your earlier yesterday, but work comes first.

The text i see fit is:
"While TLS supports only unicast, IPsec can support both unicast and
multicast transports."

Lets leave the rest of the discussion to protocol time.

cheers,
jamal