Subject: Secure MPLS

From: "Tissa Senevirathne" <[email-masked]>
Date: Tue, 30 Jul 2002 03:02:36 +0000

At Yokhoma during PWe3 session, it was indicated that hackers are waiting 
for the day that L2 VPN get exposed in the WAN.

In light of that I thought to restart the discussion on Secure MPLS.

The link below is Secure MPLS ID. This ID present how MPLS payloads can be 
encrypted in a similar manner like IPsec when upper layers does not have 
security capabilities. Or on links between PE to PE that are exposed to 
public networks.

http://search.ietf.org/internet-drafts/draft-tsenevir-smpls-02.txt

For those who are lot in to Security the DOI (Domain of Interpretation) for 
Secure MPLS can be found in

http://search.ietf.org/internet-drafts/draft-tsenevir-smpls-doi-01.txt

Could you provide comments and feedback.

Thanks

Tissa

_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx

---

From: Ben Black <[email-masked]>
Date: Tue, 30 Jul 2002 09:49:16 -0700

Could you elaborate further on the requirements for a secure MPLS 
mechanism?  Eager hackers seems a bit vague.

Ben

---

From: Alan Hannan <[email-masked]>
Date: Tue, 30 Jul 2002 10:27:02 -0700

I suggest that folks review the work done on Secure Frame Relay.

  -a

Thus spake Ben Black ([email-masked])

---

From: Ron Bonica <[email-masked]>
Date: Tue, 30 Jul 2002 14:22:32 -0400

Tissa,

Given that the upper layers are capable of encryption using mechanisms like
IPSEC, why would a service provider want to encrypt the contents of an MPLS
LSP?

Wouldn't you want to push the encryption function higher in the protocol
stack and closer to the network edges?

                                                    Ron

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Tissa
> Senevirathne
> Sent: Monday, July 29, 2002 11:03 PM
> To: [email-masked]; [email-masked]; [email-masked]
> Subject: Secure MPLS
>
>
>
>
>

---

From: "Andrew G. Malis" <[email-masked]>
Date: Wed, 31 Jul 2002 14:39:18 -0400

I agree with Ron.  From the end user point of view, some problems with 
service provider encryption are that the tail circuits from the customer 
premise to the service provider are unprotected (which the obvious place to 
place a covert wiretap); the encryption keys are the property of the 
service provider, not the end user; and the keys could be subject to 
government escrow or seizure depending on where you are in the world.  This 
is certainly the case in the US (see http://www.fcc.gov/calea/ ).

Cheers,
Andy

------