Subject: [Rserpool] Reminder: Security design team conference call -- Thursday Jan. 10 11AM EST

From: "Stillman Maureen (NVO-NIC/Ithaca)" <[email-masked]>
Date: Wed, 9 Jan 2002 14:13:28 -0600

I have a new version of the threat document called
draft-stillman-rserpool-threats-01.txt.  It will not be published by the
I-D editor in time for the conference call.  However, I only added one
section to it on application security.  It is included at the end of
this message FYI.  This text is taken directly from the Rserpool
requirements document.

>  -----Original Message-----
> From: 	Stillman Maureen (NVO-NIC/Ithaca)  
> Sent:	Tuesday, January 08, 2002 8:25 AM
> To:	[email-masked]'
> Subject:	Security design team conference call -- Thursday Jan. 10
> 11AM EST
> 
> We will be having our first conference call on Thursday, Jan. 10 at
> 11AM EST USA.  Ciena will sponsor the call.
> 
> Here is the phone in details:
> 
> date: Jan. 10th (Thursday)
> time: 8AM PST (11AM EST)
> dial in no.: 410-694-5999
> meeting ID no.: 2960
> 
> The agenda will be:
> 
> design of a security architecture and mechanisms for Rserpool
> 
> For a discussion of the security threats to Rserpool please see the
> Internet-Draft:
> draft-stillman-rserpool-threats-00.txt
> 
> I have received e-mail from 9 people so far saying they wish to join
> the design team.  Anyone is welcome.  Please send me an e-mail if you
> wish to join.
> 
------------------ New section for threat document
-------------------------------

2.13  Security State for Applications

The security context of an application is a subset of the overall
context, and context or state sharing is explicitly out-of-scope for
RSerPool. Because RSerPool does introduce new security vulnerabilities
to existing applications application designers employing RSerPool should
be aware of problems inherent in failing over secured connections.
Security services necessarily retain some state and this state may have
to be moved or re-established. Examples of this state include
authentication or retained ciphertext for ciphers operating in cipher
block chaining (CBC) or cipher feedback (CFB) mode. These problems must
be addressed by the application or by future work on RSerPool.

Requirement: None at this time.  Future Rserpool work may address this
issue.

> -- maureen

_______________________________________________
rserpool mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/rserpool