Subject: 2401bis Issue # 90 -- Remove the selector "data sensitivity level"

From: Karen Seo <[email-masked]>
Date: Wed, 22 Oct 2003 23:31:38 -0400

Folks,

Here's a description and proposed approach for:

IPsec Issue #:	90

Title:		Remove the selector "data sensitivity level"

Description
===========
In the interest of simplifying things, we propose to remove the 
selector "data sensitivity level".  Is anyone using this selector?

Proposed approach
=================
Remove text such as the following:

    [From Section 4.4.2 "Selectors"]
    "- Data sensitivity level: (IPSO/CIPSO labels)

       [REQUIRED for all systems providing information flow
       security as per Section 8, OPTIONAL for all other
       systems.]"

    "8.1 Relationship Between Security Associations and Data
     Sensitivity

       Both the Encapsulating Security Payload and the
       Authentication Header can be combined with appropriate
       Security Association policies to provide multi-level
       secure networking.  In this case each SA (or SA
       bundle) is normally used for only a single instance of
       sensitivity information.  For example, "PROPRIETARY -
       Internet Engineering" must be associated with a
       different SA (or SA bundle) from "PROPRIETARY -
       Finance"."

Thank you,
Karen

---

From: Dan McDonald <[email-masked]>
Date: Thu, 23 Oct 2003 10:08:14 -0400

> Title:		Remove the selector "data sensitivity level"

Not yet, but soon.

I would highly recommend keeping this text in 2401bis.  Some of us fought
very hard to keep it in 2401, and don't wish to see it go away just yet.

If you wish it to be more simple for a non-MLS someone reading the spec, you
should place the additional selector text in section 8 somewhere.  Keep in
mind, this selector allows two MLS systems to use separate SPD entries to
protect different sensitivity-level data with appropriate protection.

Dan

---

From: Stephen Kent <[email-masked]>
Date: Sun, 26 Oct 2003 22:23:07 -0500

Dan,

Yes, I know what the selector is for, but we were not seeing any use 
and thus we felt it appropriate to ask the question.  Note that the 
DoD-approved IP layer crypto devices do not implement IPsec quite as 
we defined it and so it does not seem critical that we maintain this 
for their benefit.

However, I think that so long as we make this a feature that MUST be 
implemented ONLY by IPsec systems that support labelled security 
features, it will not cause problems for other vendors and so I guess 
we could leave it in with the same sort of caveats we now have.

steve

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Sun, 26 Oct 2003 20:15:07 -0800

At 10:23 PM -0500 10/26/03, Stephen Kent wrote:
>features, it will not cause problems for other vendors and so I 
>guess we could leave it in with the same sort of caveats we now have.

Or we could remember that we are trying to simplify things (strange, 
I know) and remove it because no one uses it.

--Paul Hoffman, Director
--VPN Consortium