Subject: [anonsec] Re: request for posts on separate WG vs. merged

From: hartmans-ietf at mit.edu (Sam Hartman)
Date: Sun Jan 2 14:05:30 2005

>>>>> "Michael" == Michael Richardson <[email-masked]> writes:

    Michael>   My question: would you wish to *AVOID* making certain
    Michael> queries if you knew that DNS wasn't over BTNS?  If so,
    Michael> then you need to make the ability to notify the
    Michael> applications about the BTNS status.

I have to agree that long-term applications need to be able to know
whether BTNS is being used.  Applications also need to be able to know
when the BTNS identity of the peer changes.

There are lots of ways of implementing this.  One way is to provide
notifications to an application.  Another way is to allow an
application to make policy assertions like "this traffic selecter will
use BTNS and once the peer identity is established it must not change
until this policy assertion is removed."  

There are significant issues that would need to be worked through for
either approach.  For the policy approach, you would need to make sure
that BTNS policy could not be used to subvert normal IPsec policy.
You'd also need to consider denial of service and conflicts between
different applications' policies.

For the notification approach, you would need to figure out how to
track enough state to notify applications.

--Sam

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Sun Jan 2 18:07:40 2005

Yes, IPsec APIs are necessary for BTNS to shine.  But that's really true
of IPsec as well, at least for applications beyond tunnels or transport
mode SAs authenticated with host credentials.  Some platforms have some
such APIs, but a generic specification (like rfc2743, but probably not
like rfc2744) would be good to have.

Generic IPsec APIs, BTNS, channel bindings to IPsec -- the IETF needs
all of these, and look, we are aware of this and are working towards all
three.  I'm not too concerned if these work items progress at different
speeds, as long as they progress.

Nico
--

---

From: paul.hoffman at vpnc.org (Paul Hoffman / VPNC)
Date: Sun Jan 2 18:53:13 2005

At 8:04 PM -0600 1/2/05, Nicolas Williams wrote:
>of IPsec as well

Fully agree. Further, I don't see why you would have them in one 
without the other.

--Paul Hoffman, Director
--VPN Consortium