Subject: RE: [Seamoby] Verifying that a sender is a GAAR

From: "Pat R. Calhoun" <[email-masked]>
Date: Tue, 19 Mar 2002 17:56:45 -0800

That is certainly one option, but not specifying the exact details of
how to secure the protocol leads to interoperability problems among
vendors - not something we really want in a truly mobile world.

PatC

- -----Original Message-----
From: Phil Neumiller (N9FCW) [mailto:[email-masked]] 
Sent: Tuesday, March 19, 2002 7:33 PM
To: James Kempf
Cc: [email-masked]
Subject: Re: [Seamoby] Verifying that a sender is a GAAR

Thanks for the reminder Jim.  I just see soooo much discussion about
security in MIP and now SeaMoby that it seems to detract from the
real issues sometimes and bog things down.
Maybe I believe too much in security Pixie dust.... :-)    BTW, there
are
some nice commercial
options becoming available with small foot prints for embedded
devices with full PKI implementations.  These packages can solve many
of the problems that are discussed, however, they are not
necessarilly IETF created (not invented here).  Is it possible to
specify a level of encryption that is required and the necessary
hooks and leave the implementation up to network equipment
vendors/manufacturers or does the IETF have to solve the worlds
problems?

Best regards,

- -Phil
- ----- Original Message -----
From: "James Kempf" <[email-masked]>
To: "Phil Neumiller (N9FCW)" <[email-masked]>;
"Hemant Chaskar" <[email-masked]>; <[email-masked]>
Sent: Monday, March 18, 2002 9:08 PM
Subject: Re: [Seamoby] Verifying that a sender is a GAAR

> Phil,
>
> Every Internet draft is required to have a section called "Security
>  Considerations." This section must deal with how the particular 
> protocol or standard handles security. There has been a history in 
> IETF of saying "use IPsec" in this section (commonly called "IPsec 
> pixie dust"), thus putting the burden of security design for the 
> protocol on the IPsec WG (in effect, deferring it). In the last
> year,  this has changed and the IESG has been requiring that the
> sections  contain more substance saying specifically how the
> protocol will use  IPsec, if the WG proposes that it should, or
> explicitly describing how  security is done if not.
>
> The theory behind pushing security back on the WG is that the WG is
> in  a better position to know what the security solutions are for
> their  particular protocol than the IPsec WG. Not that everybody in
> the WG  should necessarily care, but at least someone with some
> security 
> background and interest should.
>
> Thus, the security groups like IPsec and IKE now concern themselves
>  specifically with protocols that do security and not with the
> security  design for other protocols. It is analgous with MIBs. The
> SNMP working  group doesn't do MIBs for other protocols, they work
> on SNMP.
>
>             jak
>
> PS: If you don't like it, then I'd suggest you complain at the IESG
>  Plenium on Thurs. nite if you are in Minneapolis, or to someone
> from  the IESG  Security Area Directorate if not.
>
>
> ----- Original Message -----
> From: "Phil Neumiller (N9FCW)" <[email-masked]>
> To: "James Kempf" <[email-masked]>; "Hemant Chaskar" 
> <[email-masked]>; <[email-masked]>
> Sent: Monday, March 18, 2002 5:38 PM
> Subject: Re: [Seamoby] Verifying that a sender is a GAAR
>
>
> > What makes you so sure of this James?  Security concerns belong
> > in the security WG.   I guess  I have said this about 100 times
> > now.  Recall 
> that
> > the charter of the WG deals with seamless mobility, not security.
> >
> > ----- Original Message -----
> > From: "James Kempf" <[email-masked]>
> > To: "Hemant Chaskar" <[email-masked]>; <[email-masked]>
> > Sent: Monday, March 18, 2002 11:07 AM
> > Subject: [Seamoby] Verifying that a sender is a GAAR
> >
> >
> > > Hemant,
> > >
> > > The purpose of putting authentiation onf any GAAR information
> > > is  precisely to allow a receive to trust that the information
> > > came  from
> a
> > > reliable source. The only other way a receiver could determine 
> > > that
> a
> > > router claiming to be a GAAR is, in fact, a GAAR would be to
> > > get  information from another source that it trusted and
> > > compare it.  But
> how
> > > would the receiver trust that? Putting a signature on the GAAR 
> > > information and requiring a trust relationship ensures that the
> receiver
> > > can trust the GAAR information.
> > >
> > >             jak
> > >
> > >
> > >
> > > _______________________________________________
> > > Seamoby mailing list
> > > [email-masked] https://www1.ietf.org/mailman/listinfo/seamoby
> > >
> > >
> >
> >
> >
>
>
>

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: "James Kempf" <[email-masked]>
Date: Tue, 19 Mar 2002 18:13:10 -0800

> vendors - not something we really want in a truly mobile world.

The level of specification has to be up to interoperability, so
that vendors can provide interoperable implementations.

        jak

> -----BEGIN PGP SIGNATURE-----
> Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
>
> iQA/AwUBPJfsXjN1fXKoxmisEQLFmgCg407t8iQdVMy+7IgUAJdVSejZ2soAnRMf
> qhuQOG7rWHQVpRNRXatM43vz
> =QOIx
> -----END PGP SIGNATURE-----
>

---

From: "James Kempf" <[email-masked]>
Date: Tue, 19 Mar 2002 18:13:10 -0800

jak