Subject: RE: [NSIS] next peer issue in rsvp-sec

From: [email-masked]
Date: Wed, 27 Nov 2002 14:57:23 +0200

Michael,

> In fact, RSVP has two different authentication
> needs: hop-by-hop which is fairly analogous to the
> IGP problem and the more abstract e2e/e2m/m2m kind
> of problem which RFC 2752 talks about. This
> problem is both a) harder and b) not unique to
> RSVP (SIP and any other proxiable protocol usually
> run into the same problem).

Exactly.
 
> What I keep wondering about is whether an app
> layer auth/encryption abstraction would be useful
> for all (or many at least) of these problems that
> keep popping up. SIP, for example, did a pretty
> bad job of solving this problem.

So, I think that part of the 2 layer functional split
that we need to work on should try to address this.
I prefer to have the upper layer handle the authentication
and payload encryption part.  The lower layer could
just work on transport layer security, which is very
useful in protecting various DoS problems.  Of course,
the devil's in the details.

John
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Melinda Shore <[email-masked]>
Date: Wed, 27 Nov 2002 08:08:38 -0500

> and payload encryption part.

I'd swap some words around and to say "upper layer handle
the payload authentication and encryption part."  Basically
all we're saying is that the application needs to protect
itself against threats against the application and that the
transport layer needs to protect itself against threats
against the transport.

Melinda