Subject: [Seamoby] Security Requirements in CAR Discovery?

From: "Govind Krishnamurthi" <[email-masked]>
Date: Wed, 13 Mar 2002 14:35:18 -0500

James,

>And, in fact, this brings up another issue. The current requirements are
>completely lacking *any* mention of security. But I will address that in
>another note so as not to confuse the threads.

---> This is an important issue. So I started a new thread.
This discussion did come up Madjid Nakhriji (from Motorola)
about security during inter-domain CAR discovery. I did explain to him about 
what kind of security we had in mind when writing the current set of 
requirements. The current set of requirements goes to the extent of saying 
that the capabilities MUST be exchanged in a secure fashion.  I agree that 
SAs MUST be established between entities involved
in CAR discovery. Do you have any wording in mind? Do you feel CAR discovery 
imposes special security requirements other than the SAs described in the 
previous sentence. Ofcourse, particular solutions may
require security handling, but  do we address that in a requirements draft 
meant for the problem, rather than a particular solution?
I would  think that these particular solutions should make sure that they do 
not have  security holes. Also, we don't know how these solutions which are 
all in the 00 version will evolve in the future.

Regards,
Govind.

_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby