Subject: RE: [NSIS] Req-Draft: Open Issue 4: Confidentiality of signaling messages

From: "Geib, Ruediger" <[email-masked]>
Date: Tue, 5 Nov 2002 09:58:27 +0100

Hello Hannes,

you seem to raise an archcitectural aspect. I agree, 
Midcom signaling may require encryption. QoS 
signaling may do well with integrity protection. 
Would you agree that certain "upper level signaling 
protocols" may have to be encrypted while others 
don't have to be? Or is it already the CSTP level 
which must be encrypted?

Regards, Rüdiger

> > Rüdiger wrote:
> > I agree with Bob that encryption of signaling messages
> > is an option, not a requirement.
 
> Hannes wrote
> what i would like to prevent is that a requirement for 
> encryption is so fuzzy that actually nobody applies it 
> their protocol proposals. adding confidentiality 
> protection later to a protocol is often quite 
> difficult.
> protocol designers should consider it during the initial 
> design.  an area where is see a need for confidentiality
> protection is communication of policy rules (midcom). 
> providing protection against traffic  analysis is also
> a good goal to achieve looking at the increasing importance
> of privacy issues.
 
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 5 Nov 2002 12:10:43 +0100

hi ruediger!

> don't have to be?
no. i would generally like to see encryption because it adds security. the
policy rules for midcom was only one example. to prevent traffic analysis
and eavesdropping confidentiality protection might also be useful for qos
signaling. in the future other application protocols might be added. they
also might require encryption. if confidentiality protection is considered
during the protocol design phase then it is later only the signaling message
initiators choice to select it. it is true that in some environments (for
example dial-up links) it might not be required. if confidentiality
protection is not considered at all then i argue that it is hard to add.

> Or is it already the CSTP level
> which must be encrypted?
it always depends what information you deliver at each each level/layer. the
seperation between these layers is only at a document level/logical and not
physical!?
providing different security mechanisms at different layers is more
difficult.

ciao
hannes