Subject: RE: [NSIS] RMD-QoS-NSLP model draft submitted to NSIS

From: "Hancock, Robert" <[email-masked]>
Date: Tue, 17 Feb 2004 15:40:40 -0000

hi all,

GIMPS can only provide integrity protection between adjacent
QNEs. if a QNE needs to send a message with a policy object
and have it received with intact integrity protection several
QNEs away, this integrity protection must be provided within
the QoS NSLP.

r.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]
> Sent: Tuesday, February 17, 2004 16:30
> To: [email-masked]
> Cc: Thanh Tra LUU; [email-masked]
> Subject: Re: [NSIS] RMD-QoS-NSLP model draft submitted to NSIS
> 
> 
> nary,
> 
> QoS-NSLP POLICY_DATA object carries policy elements for authorization 
> purposes between two policy-capable nodes. like what was done in RSVP.
> 
> how far QoS-NSLP relies on NTLP for the so-called integrity objects 
> (RSVP terminology) is the issue.
> 
> yacine
> 
> 
> 
> [email-masked] wrote:
> 
> > Hi Nary,
> > 
> > QoS NSLP has POLICY_DATA in its current version of the 
> spec. Even if GIMPS
> > provides integrity, I am not sure it is unneeded in QoS 
> NSLP (e.g. if QoS
> > NSLP is carrying information that is opaque for (some) 
> intermediate nodes).
> > 
> > Sven
> > 
> > 
> > 
> > 
> > 
> > 
> > "Thanh Tra LUU" <[email-masked]>@ietf.org on 17/02/2004 15:53:29
> > 
> > Sent by:    [email-masked]
> > 
> > 
> > To:    <[email-masked]>
> > cc:
> > Subject:    Re: [NSIS] RMD-QoS-NSLP model draft submitted to NSIS
> > 
> > 
> > hi Sven,
> > 
> > 
> >>Sven>> Imho, the QoS NSLP should rely on GIMPS for some/most of its
> >>security services but GIMPS alone is not sufficient because 
> it does not
> >>protect against compromised QNEs, only against their 
> interconnection.
> > 
> > 
> > do you mean QoS-NSLP would support authentication policy 
> elements (as rsvp)
> > and NTLP would support integrity elements (in rsvp) or 
> QoS-NSLP may do all
> > in some cases ?
> > 
> > Nary Tra,
> > ENST, Paris.
> > 
> > 
> > _______________________________________________
> > nsis mailing list
> > [email-masked]
> >  https://www1.ietf.org/mailman/listinfo/nsis
> > 
> > 
> > 
> > 
> > 
> > _______________________________________________
> > nsis mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/nsis
> > 
> 
> 
> 
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Thanh Tra LUU" <[email-masked]>
Date: Tue, 17 Feb 2004 17:08:36 +0100

hi all,

> QNEs away, this integrity protection must be provided within

does QoS-NSLP really need to require NTLP more than it (integrity protection
between adjacent QNEs) ?

Nary Tra,
ENST, Paris.

---

From: David Oran <[email-masked]>
Date: Tue, 24 Feb 2004 08:21:00 -0500

> QNEs away, this integrity protection must be provided within
and once you have this requirement, what exactly does the security provided 
by the transport level buy you? Bulk encryption? It seems if multiple xNE 
protocol elements are to be multiplexed over the same transport, but the 
xNE topology which processes these elements is not congruent, I wonder if 
the transport level security (e.g. TLS) can be relied on for much of 
anything.

I must be missing something here, since one of the strongest motivations 
for a C-mode transport was exactly this.

Confused, Dave.