Subject: [GROW] consensus on BMP security IPSEc vs TLS

From: Peter Schoenmaker <[email-masked]>
Date: Wed, 16 Dec 2015 22:51:51 +0000

Hello,

We have reached the final stretch for draft-ietf-grow-bmp, but have hit a hiccup with regards to the proposal on the mechanism specified to secure the data.  We need to reach consensus on the text in the draft.  There has been extensive discussion on the mailing list.  

The authors have proposed the following text using IPSec:

Replace: This document does not specify any security mechanism for BMP.

With:  Where the security considerations outlined above are a concern, users
  of this protocol should use IPsec [RFC4303] in tunnel mode with
  preshared keys.

Can participants affirm the text is sufficient to cover securing BMP data?  If you feel it is not sufficient, propose alternate text for the document.

Thanks

Peter

---

From: joel jaeggli <[email-masked]>
Date: Tue, 22 Dec 2015 09:13:04 -0800

fwiw it works for me I guess.

On 12/16/15 2:51 PM, Peter Schoenmaker wrote:
> Hello,
> 
> We have reached the final stretch for draft-ietf-grow-bmp, but have hit
> a hiccup with regards to the proposal on the mechanism specified to
> secure the data.  We need to reach consensus on the text in the draft.
>  There has been extensive discussion on the mailing list.  
> 
> Can participants affirm the text is sufficient to cover securing BMP
> data?  If you feel it is not sufficient, propose alternate text for the
> document.
> 
> Thanks
> 
> Peter
> 
>

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 22 Dec 2015 17:47:13 +0000

> fwiw it works for me I guess.

And that's enough for me to clear my discuss too, yes.

I guess saying IPsec is better than maybe badly specifying
how to do TLS, even though TLS is the more sensible thing
to do,

S

---

From: joel jaeggli <[email-masked]>
Date: Tue, 22 Dec 2015 10:30:18 -0800

> how to do TLS, even though TLS is the more sensible thing

If it goes towards addressing Kathleen's Discuss so much the better.

---

From: Randy Bush <[email-masked]>
Date: Wed, 23 Dec 2015 04:41:28 +0900

> how to do TLS, even though TLS is the more sensible thing

and un-badly specifying tls is not possible?

randy

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 22 Dec 2015 19:49:03 +0000

> and un-badly specifying tls is not possible?

I'd say entirely possible, given some interest and
effort.

S

---

From: joel jaeggli <[email-masked]>
Date: Tue, 22 Dec 2015 11:53:48 -0800

> I'd say entirely possible, given some interest and

And of course implementation.