Subject: Re: [MSEC] [OSPF] [sidr] [RPSEC] Authentication for OSPFv3

From: [email-masked] (Sandy Murphy)
Date: Tue, 30 Sep 2008 12:28:23 -0400 (EDT)

>I agree to what you say and the general sense of the room in the KMART BOF.
>That is the reason I proposed a BTNS based solution. Which uses GTSM
>in the IKe to do the first level security.

I am not quite sure I understand the use of GTSM here.  The need for
authentication for OSPF is that you don't trust that everyone on the
local broadcast link is OK.  GTSM tells you that the sender came from
one-hop away, i.e., on the local broadcast link.  Since you already know
that you don't trust everyone one-hop away, how does the use of GTSM
help?

--Sandy
_______________________________________________
MSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/msec

---

From: [email-masked] (Sandy Murphy)
Date: Tue, 30 Sep 2008 12:28:23 -0400 (EDT)

--Sandy

---

From: [email-masked] (Sandy Murphy)
Date: Tue, 30 Sep 2008 12:36:04 -0400 (EDT)

By the way, to everyone who sees this message, the mail chain is really
broken.  Ed's message did not get to all the wg lists on his message,
and I got several "too many recipients" errors on my reply.  If you look
at the mail archives for the various wg, not any of them have caught all
the messages that have been send.

I think the secdir archive got most of the messages (except the one that
Dave Ward cut down to just the rpsec list :-)), but it is not a public
list.

I'm not even sure that Ed, who originally posed the question, is seeing
the exchange.  (Ed's message was attached to my reply, if you saw that.)

I was able to push out the messages that got trapped for the sidr list,
but if any other wg chairs could do their bit, maybe the conversation
will be less fractured.

Or maybe we should just all choose one list to do the conversation.

--Sandy

---

From: [email-masked] (Sandy Murphy)
Date: Tue, 30 Sep 2008 12:36:04 -0400 (EDT)

--Sandy