Subject: [anonsec] Question on applicability statement

From: sharipriya at novell.com (Haripriya S)
Date: Fri, 26 Aug 2005 04:40:50 -0600

Hi,

I have gone through the applicability statement of BTNS and I am not
very clear about the implications of CCB. For example, section 4.1
states

BTNS is intended to protect the network and transport layer between 
   two parties after an association is established. SAB is not intended

   to protect to whom associations are established based on 
   authenticated identity. CBB does not protect with whom associations

   are established initially, but allows higher layer protocols that 
   provide authentication to couple to network layer security after the

   association is established, at which time the association can be 
   adjusted accordingly. 

Since higher layer protocols could authenticate multiple identities
(think of two ftp client sessions from the same machine), does it mean
that CCB will allow the higher layer protocols to couple 'the same
network level SA to each of these higer level identities'? How does that
work?

Thanks,
Haripriya S.

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Fri, 26 Aug 2005 10:38:28 -0500

> network level SA to each of these higer level identities'? How does that

So, when using channel bindings to bind authentication at higher layers
to secure channels at lower layers one must first have such a channel to
bind to.

IPsec does not define such channels, not as such anyways, but it is
possible to construct them.  My presentation dwelt on this briefly;
there are at least two IPsec implementations that provide such channels
through cooperation between the application and transport layer and the
latter's dynamic manipulation of the SPD, in a way.

Nico
--

---

From: touch at ISI.EDU (Joe Touch)
Date: Fri, 26 Aug 2005 11:09:14 -0700

> latter's dynamic manipulation of the SPD, in a way.

It might be useful to tap this statement, or some more specific text you
might offer, to address this in the PS/AS.

Joe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/anonsec/attachments/20050826/1fb8bf3f/signature.bin

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Fri, 26 Aug 2005 18:23:49 -0500

> might offer, to address this in the PS/AS.

Indeed!

How about adding this to section 2.2?

   Of course, in order to perform channel binding there must be a
   channel to bind to; IPsec defines no such channels, though such
   channels can be constructed by transports layered above IP through
   cooperation between the transports and IPsec to ensure that all
   packets for a given channel are protected by similar SAs, where
   similar relates to, among other things, the IDs of the peers.

   Interfaces between applications and the transports are also needed
   for communicating channel binding data to applications, and may be
   needed as well as for applications to construct their own IPsec
   channels over connection-less, datagram-oriented transports.

Nico
--

---

From: touch at ISI.EDU (Joe Touch)
Date: Sat, 27 Aug 2005 15:51:08 -0700

We'll insert the following as per Nico's suggestion in this version,
unless there are editing suggestions or objections on this list shortly.

Joe

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 254 bytes
Desc: OpenPGP digital signature
Url : http://www.postel.org/pipermail/anonsec/attachments/20050827/0a4ccc57/signature.bin