Subject: L2TP security

From: "[email-masked]" <[email-masked]>
Date: Tue, 8 Feb 2000 19:27:19 +0530

Hi,

   Please clear this doubt. If L2TP runs over UDP IPsec can be used for 
security, but if the L2TP media is ATM then is there any security protocol.
Does this mean it is better to have L2TP over UDP/IP media.

Thanks in advance.

Regards,
Arul.

---

From: Rene Tio <[email-masked]>
Date: Tue, 8 Feb 2000 08:55:06 -0800

Frame Relay privacy and ATM security are, to my knowledge, still works in
progress.  That does not mean there are no implementations though.  If you
need security, go with whatever works in your network, whether IPsec or ATM
or FR privacy, since L2TP is largely ignorant of the lower layer.

If you run L2TP over running shoes, as the WG chairs once claimed you could,
be sure to arm the person wearing them and chain the packet to his wrist.

Cheers,
Rene

---

From: "W. Mark Townsley" <[email-masked]>
Date: Tue, 08 Feb 2000 17:39:25 -0500

1. ECP does not protect the L2TP headers.
2. ECP waves its hands at this tiny thing known as Key Distribution.

Srinivasan Chakravarthy wrote:
> 
> I have a question for you. If PPP supports ECP to encrypt the data, why do you
> need some other protocol to encrypt the data when L2TP is run over ATM or any
> other medium than UDP/IP ?
> 
> [email-masked] wrote:
> 
> > Hi,
> >

---

From: Srinivasan Chakravarthy <[email-masked]>
Date: Tue, 08 Feb 2000 14:13:57 -0800

---

From: Rene Tio <[email-masked]>
Date: Tue, 8 Feb 2000 14:37:12 -0800

Different ways of skinning a cat.  Suppose you want authentication only and
not privacy.  Or possibly hardware constraints (I'm stepping way out of
where I can speak coherently here), where you'd be encrypting/de-encrypting
a single stream (the tunnel) versus thousands of PPP sessions.

Of course we can get into a LONG discussion over why you would want privacy
over the Internet when that box outside your house is so accessible, but
let's not.

Rene

---

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 10 Feb 2000 07:45:04 -0800

In addition to the deficiencies that Mark mentioned, most ECP
ciphers offer encryption without integrity protection. This
creates a vulnerability to "bit flipping" attacks. Plus, without
integrity-protecting the PPP LCP and NCP packets, you open
yourself to "negotiation downgrade" attacks.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Srinivasan Chakravarthy
Sent: Tuesday, February 08, 2000 2:14 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: L2TP security

I have a question for you. If PPP supports ECP to encrypt the data, why do
you
need some other protocol to encrypt the data when L2TP is run over ATM or
any
other medium than UDP/IP ?