Subject: RE: [NSIS] next peer issue in rsvp-sec

From: "Hancock, Robert" <[email-masked]>
Date: Wed, 27 Nov 2002 20:35:06 -0000

So, I'd like to check I understand the subtleties of the wording correctly:

the NTLP needs to protect itself against threats against the transport (and I guess below), which we think of as things like DoS, some confidentiality aspects (traffic analysis), could be done with something channel-security-like?
(or we think of just DoS protection, probably no cryptographic protection?)

whereas an NSLP would have application specific protection of elements of the payload (integrity protection and authorisation aspects)?

This would certainly seem reasonable to me and was my working assumption going into Atlanta (at least up to the point where Melinda very reasonably pointed out we should have a clearer picture of the NTLP functionality before deciding its security requirements...)

However, I don't think the layer split tells us anything about how technically to address the next-peer issue we started with.

Robert H.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: 27 November 2002 13:15
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: RE: [NSIS] next peer issue in rsvp-sec 
> 
> 
> Hi Melinda,
> 
> Your wordsmithing works for me.
> 
> John
> 
> > -----Original Message-----
> > From: ext Melinda Shore [mailto:[email-masked]]
> > Sent: 27 November, 2002 15:09
> > To: Loughney John (NRC/Helsinki)
> > Cc: [email-masked]; [email-masked]
> > Subject: Re: [NSIS] next peer issue in rsvp-sec 
> > 
> > 
> > > So, I think that part of the 2 layer functional split
> > > that we need to work on should try to address this.
> > > I prefer to have the upper layer handle the authentication
> > > and payload encryption part.
> > 
> > I'd swap some words around and to say "upper layer handle
> > the payload authentication and encryption part."  Basically
> > all we're saying is that the application needs to protect
> > itself against threats against the application and that the
> > transport layer needs to protect itself against threats
> > against the transport.
> > 
> > Melinda
> > 
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Melinda Shore <[email-masked]>
Date: Wed, 27 Nov 2002 16:00:26 -0500

I really don't think that at this point we need anything
more elaborate than a recognition that the security
functions used in each layer must be appropriate to that
layer, and that the application's issues are certainly going
to be different from those of the transport protocol.  The
requirements and framework don't have to be enormously
detailed.

Melinda