Subject: [Tsvwg] new I-D: TCP Simple Authentication Option

From: Joe Touch <[email-masked]>
Date: Fri, 09 Jun 2006 15:01:26 -0700

Hi, all,

The following I-D has just been submitted. It is intended to provide a
simpler alternative to updating TCP/MD5. Comments welcome.

It is currently available at:
http://www.isi.edu/touch/pubs/draft-touch-tcpm-tcp-simple-auth-00.txt
(and should appear in the usual places very shortly)

Joe and Allison

---------------------------------------------------

TCPM WG                                                        J. Touch
Internet Draft                                                  USC/ISI
Expires: December 2006                                        A. Mankin
                                                           June 9, 2006

                   The TCP Simple Authentication Option
                  draft-touch-tcpm-tcp-simple-auth-00.txt
...
Abstract

   This document specifies a TCP Simple Authentication Option (TCP-SA)
   which is intended to replace the TCP MD5 Signature option of RFC-2385
   (TCP/MD5). TCP-SA specifies the use of stronger HMAC-based hashes and
   provides more details on the association of security associations
   with TCP connections. TCP-SA assumes that rekeying is supported by
   restarting the TCP connection, and so omits in-band parameter
   negotiation, session key establishment, and rekeying support; where
   such features are desired, use of the IPsec suite is recommended.
   The result is intended to be a simple modification to support current
   infrastructure uses of TCP/MD5, such as to protect BGP and LDP, to
   support a larger set of hashes with minimal other system and
   operational changes. TCP-SA requires no new option identifier, though
   it is intended to be mutually exclusive with TCP/MD5 on a given TCP
   connection.

---

From: Lars Eggert <[email-masked]>
Date: Wed, 14 Jun 2006 17:34:45 +0300

Hi,

(TSVWG BCC'ed.)

There is an active discussion on the tcpm list about this ID (draft- 
touch-tcpm-tcp-simple-auth), draft-bonica-tcp-auth and the overall  
approach of replacing TCP-MD5 and/or securing BGP.

The TSV ADs would like to ask the community to contribute to this  
discussion. There is a general agreement that we need to move away  
from TCP-MD5, but there isn't a clearly identified candidate  
mechanism that current users of TCP-MD5 should migrate to. We're  
trying to get a feeling on the view of the TSV community on this issue.

Thanks,
Lars

PS: In order to not fragment the discussion, please respond on the  
tcpm list.
-- 
Lars Eggert                                     NEC Network Laboratories

---

From: Joe Touch <[email-masked]>
Date: Sun, 25 Jun 2006 19:37:40 -0700

Hi, all,

The above I-D has just been updated. It is intended to provide a
simpler alternative to updating TCP/MD5. Comments welcome.

The update allows rekeying during a connection, and as a result removes
all discussion of BGP graceful restart. It still assumes that all key
management is external to TCP; this is similar to how the IKE is
external to AH/ESP in the IPsec suite.

It is currently available at:
http://www.isi.edu/touch/pubs/draft-touch-tcpm-tcp-simple-auth-01.txt
(and should appear in the usual places very shortly)

Joe and Allison