Subject: RE: [NSIS] nsis meeting minutes

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 4 Dec 2003 14:55:14 +0100

hi john, 
hi jukka, 

excellent - someone actually reads the meeting minutes. i fixed the problem.

ciao
hannes

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Thursday, December 04, 2003 2:32 PM
> To: [email-masked]; Tschofenig Hannes
> Cc: [email-masked]
> Subject: RE: [NSIS] nsis meeting minutes
> 
> 
> I think that the minutes should be updated to say that the draft will
> be resubmitted then WG LC will be started.
> 
> John
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On 
> Behalf Of ext
> > Jukka MJ Manner
> > Sent: 04 December, 2003 15:26
> > To: Tschofenig Hannes
> > Cc: [email-masked]
> > Subject: Re: [NSIS] nsis meeting minutes
> > 
> > 
> > 
> > Hi Hannes, John,
> > 
> > I don't quite get what the first line of the Agenda Bashing says?
> > 
> > "Jukka's presentation on the Analysis document will be 
> > skipped. His draft 
> > will be resubmitted to the IESG (based on the incorporated 
> comments)."
> > 
> > Mainly "resubmitted to the IESG"? Has there been a WG LC 
> > already? Weren't
> > you, John, supposed to initiate that during/after the 
> > Minneapolis meeting?
> > 
> > Regards,
> > Jukka
> > 
> > On Thu, 4 Dec 2003, Tschofenig Hannes wrote:
> > 
> > > hi all, 
> > > 
> > > here are the meeting minutes. please let me know if you 
> > would like to see
> > > some changes. 
> > > 
> > > http://www.tschofenig.priv.at/nsis/IETF58/
> > > 
> > > as usual you will also find pointers to the presentation 
> > slides and some
> > > pictures.
> > > 
> > > ciao
> > > hannes
> > > 
> > > _______________________________________________
> > > nsis mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/nsis
> > > 
> > 
> > 
> > 
> > _______________________________________________
> > nsis mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/nsis
> > 
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Thanh Tra LUU" <[email-masked]>
Date: Sun, 21 Dec 2003 16:26:51 +0100

hi Tschofenig,

I've read your draft on RSVP DOI. I just want to know the reason why you've
written RSVP DOI other than a new Protocol ID in IPSec DOI. Does it seem
that IPSec WG does not want a new Protocol ID as someone has proposed a new
Protocol ID for TLS ?

Sorry if I missed some mails.

Nary Tra,
ENST, Paris

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Sun, 21 Dec 2003 17:01:26 +0100

hi nary,

thanks for reading the draft.

the idea behind the rsvp doi was the following :

- leave rsvp as it is
- add key management to it (since the integrity object does not provide it)
- reuse existing authentication and key exchange mechanisms

hence i only reused ike without touch ipsec. richard graveman made me aware
of work in the atm forum which did something similar (with a different
intention).

you might want to take a look at a few slides:
http://www.tschofenig.priv.at/nsis/RSVP_DoI.ppt

how would your protocol id procedure work for tls?

ciao
hannes

> -----Ursprüngliche Nachricht-----
> Von: Thanh Tra LUU [mailto:[email-masked]]
> Gesendet: Sonntag, 21. Dezember 2003 16:27
> An: Tschofenig Hannes
> Cc: [email-masked]
> Betreff: Draft RSVP DOI
>
>
> hi Tschofenig,
>

---

From: "Thanh Tra LUU" <[email-masked]>
Date: Sun, 21 Dec 2003 17:41:54 +0100

hi Tschofenig,

>- reuse existing authentication and key exchange mechanisms

I agree that we should use some protocols to establish SAs for RSVP.
However, I don't see the reason why you don't touch ipsec doi (not ipsec).

>how would your protocol id procedure work for tls?

I dont understand your question. However, you can see the paper at Globecom
03 (in the Security Symposium) on TLS ( they have propsed Protocol ID=5 for
TLS).

Nary Tra,
ENST, Paris

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Mon, 22 Dec 2003 09:10:35 +0100

hi nary tra,

> However, I don't see the reason why you don't touch ipsec doi (not

there are two ways which you can go:

a) use ipsec as it is
in the 'rsvp security properties' we indicate that this is not as simple as
it sounds (due to the protocol machinery of rsvp).

b) use application layer security (i.e., the rsvp integrity object)

the ipsec doi does not create rsvp sas for us. hence i had to use another
doi for establishing exactly the parameters and attributes i want.

i must admit that i haven't finished it since rsvp also supports multicast
but currently the rsvp doi draft is silent about it (since nobody is really
interested in multicast handling).

in this case i would, for example, switch from sequence numbers to
timestamps for authentication.

a small note:
with the design followed by gimps the approach of creating your own doi is
obsolete since you can use standard ipsec.

> 03 (in the Security Symposium) on TLS ( they have propsed Protocol ID=5
i guess you mean "ISAKMP Handshake for SSL/TLS
Ibrahim Hajjeh, Ahmed Serhrouchni, Ecole Nationale Supérieure des
Télécommunications, France, Frédérique Tastet, Thales Communications,
France"
http://www.globecom2003.com/COMM%20Security.html

i could find an electronic version of the paper. hence it is difficult for
me to determine whether the approach would work.

i try to order the proceedings.

ciao
hannes

btw, what's actually your first name?

---

From: "Thanh Tra LUU" <[email-masked]>
Date: Mon, 22 Dec 2003 12:15:46 +0100

hi hannes,

>doi for establishing exactly the parameters and attributes i want.

In ISAKMP framework (2408), any security protocol can have a protocol id
(ospf, tls..), so ipsec doi can be used for all. Moreover,  you can choose
your appropriate security parameters, share the same database (ipsec doi)
and switch security protocols (e.g. esp->ah, rsvp->esp)

>timestamps for authentication.

i see.  ;-)

>obsolete since you can use standard ipsec.

Do you mean gimps want to change isakmp to establish SAs before knowing the
address to which the SAs will be established ? BTW, you have proposed to use
ISAKMP, haven't you ? I do not propose any doi, i just want to know why you
don't propose a new protocol id in ipsec doi for rsvp.

>http://www.globecom2003.com/COMM%20Security.html

yes, i mean it.

>me to determine whether the approach would work.

That is also my question. The problem, i think, is ipsec doi is not an open
issue for windows.

Nary Tra,
ENST, Paris.

ps : my first name is Tra, but my friends called me Nary. So i take Nary Tra
as my name.