Subject: [v6tc] Issue 3: authentication & signaling

From: Alain Durand <[email-masked]>
Date: Tue, 18 Jan 2005 08:46:34 -0800

From the list of issues I introduced a while back, I've grouped
the ones about authentication, security & signaling.

- Do we need mutual authentication? How strong should this be?
- Should some of this authentication mechanism "follow-on" atfer the 
tunnel set-up phase
   is finished?
- Should we embed some kind of signaling in the tunnel?

Keep in mind we need to be realistic.

	-  Alain.

_______________________________________________
v6tc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/v6tc

---

From: Jeroen Massar <[email-masked]>
Date: Wed, 19 Jan 2005 09:03:24 +0100

> - Do we need mutual authentication? How strong should this be?

In case one does authentication it should be at least a handshake, thus
one which cannot be replayed nor contains any clear text passwords.

> - Should some of this authentication mechanism "follow-on" atfer the 

This depends more on what you want of course. If you want a generic "it
should always work" solution, then you do not need authentication.
If you want a solution that is at least able to verify user/pass

If you think of any security at all, outside of simply ingress
filtering, you are going to end up with a user/pass or other secret
combo and thus you will have to do some handshake somewhere.

> - Should we embed some kind of signaling in the tunnel?

For me both signaling with the purpose of authentication and signaling
that the endpoint is still alive*

Though, the first can be dropped if you only want this to be deployed
inside the same ISP's real, and thus full ingress filtering is in
effect. When there is a small assumption that there might somewhere be a
hole in the ingress filtering, authentication of each packet becomes a
MUST.

That is of course if there is this requirement to create a new protocol
at all.

Greets,
 Jeroen

* = You do not want to receive a huge amount of Firewall logs suddenly
in your abuse@ mailbox...