Subject: Re: [NSIS] Key management

From: Bob Braden <[email-masked]>
Date: Thu, 7 Nov 2002 19:44:56 GMT

With respect to hop/hop security in NSIS protocols: you should be aware
of the experience in the RSVP WG.  We were asked, "Why don't you just
use IPsec?", and we wondered why indeed.  Why spend the energy to think
through the issues of getting replay protection right, for example, if
the security folks have already produced a solution? 

It turned out that IPsec as currently defined was not directly
applicable to the hop/hop case.  It seemed quite possible to define a
third form of IPsec for this purpose, but the security folks were not
particularly interested in helping the QoS folks with their problem.
As a result, the RSVP WG was forced to roll their own (RFC 2747).
Maybe that decision can/should be revisited in NSIS.

Bob Braden

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Michael Thomas <[email-masked]>
Date: Thu, 7 Nov 2002 11:54:39 -0800 (PST)

> Maybe that decision can/should be revisited in NSIS.

FYI, Steve Bellovin just published a draft
*-useipsec-00.txt which is probably relevant to
this. Do you happen to recall the reasons why
there was pushback? I suspect I know, but it
would be good to hear it.

	 Mike

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Fri, 8 Nov 2002 09:51:40 +0100

hi bob!

> applicable to the hop/hop case.
i would like to know in which area you saw a problem with ipsec processing.

i see some problems when using ipsec with rsvp: this is related to the path
message.
to protect an rsvp message you would have to install a traffic selector for
ipsec. it cannot be based the destination address or the port since it is
not the one of the next peer. hence if you have more than two choices for a
path you do not know where the message go. in case that you have a single
router (e.g. default router) to which you send your signaling messages then
everything is fine.

>  It seemed quite possible to define a
what do you mean by third form?

> Maybe that decision can/should be revisited in NSIS.

ciao
hannes