Subject: [node req] Question on Security considerations.

From: [email-masked]
Date: Fri, 13 Feb 2004 15:07:01 +0200

Hi all,

The Security AD commented the following:

> For Section 8, RFCs 2401, 2402, and 2406 are currently being revised by 
> the IPsec group; that should be mentioned.

This is no problem.

> The crypto algorithm requirements should be better aligned with 
> recommendations from the IPsec wg.  There's a draft that lists 3DES as 
> SHOULD, not MAY.

Would it be appropriate to mention something like:

	The Security Area RECOMMENDS the use of 3DES.

> I think that IKEv? should be a SHOULD, not a MAY.  While the IESG hasn't 
> yet seen draft-bellovin-mandate-keymgmt, it will soon and it describes 
> automated key management as a "strong SHOULD".  That's certainly the 
> consensus in the security area.

I think that the WG has gone through this several times, and SHOULD has
always seemed problematic for some uses.  Does anyone have any suggestions?

> More generically, I don't think that this WG should standardize weaker 
> security requirements than the security area thinks are appropriate, 
> without strong justification.  (Stronger requirements are fine -- they 
> may have a different operational environment, or a different threat 
> model.)

My general comment is that if this document can point to existing RFCs
for the security requirements, then I am happy to mandate whatever
the pointers suggest (hint to the security area, provide pointers and
I will include them).

thanks,
John

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Russ Housley <[email-masked]>
Date: Fri, 13 Feb 2004 10:51:35 -0500

Please take a look at these two documents:
    draft-ietf-ipsec-ikev2-algorithms-04.txt
    draft-ietf-ipsec-esp-ah-algorithms-01.txt

---

From: [email-masked]
Date: Sat, 14 Feb 2004 19:50:03 +0200

Hi Russ,

>     draft-ietf-ipsec-esp-ah-algorithms-01.txt

Thanks for the pointers.  These look reasonable to add to the 
Node Req document.  Does anyone have problems with me putting
these as requirements in the Security section?

John