Subject: RE: Review of -10 security draft

From: Ernest Dainow <[email-masked]>
Date: Wed, 20 Feb 2002 12:30:13 -0500

Can you confirm that draft 10 removes the requirement that every TCP
connection must have a separate IKE Phase 2 SA? 

Some sections of the document seem to have been modified to reflect this,
but I did notice an exception, in Section 1.2 (iFCP) "Each IPsec SA
established by IKE protects a single TCP connection".

If this requirement has in fact been removed, it needs to be removed from
the other draft documents, such as FCIP and iSCSI.

-----Original Message-----
From: Joseph D. Harwood [mailto:[email-masked]]
Sent: Wednesday, February 20, 2002 11:02 AM
To: Bernard Aboba; [email-masked]
Cc: [email-masked]
Subject: RE: Review of -10 security draft

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]]
> Sent: Tuesday, February 19, 2002 2:42 PM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: Review of -10 security draft
>
>
> >How does requiring each connection to have its own Phase 2 SA
> mitigate >the
> >vulnerability in this scenario?
>
> IPsec doesn't protect against this at all, and the text needs to
> make this
> clear.
>
> Please take a look at the latest -10 security draft in progress to see if
> this addresses the issue:
>
> http://www.drizzle.com/~aboba/RDMA/draft-ietf-ips-security-10.txt
>

It does, thanks!

Best Regards,
Joseph D. Harwood
(408) 838-9434
[email-masked]
www.vesta-corp.com

---

From: Franco Travostino <[email-masked]>
Date: Wed, 20 Feb 2002 15:08:38 -0500

>established by IKE protects a single TCP connection".

Good catch. Sections 1.2, 4.2, and the iFCP document still need to absorb 
this change in full. We will need an additional pass (10 for iFCP, and 11 
for the security draft) to achieve full consistency across the board.

thanks,
-franco

> > http://www.drizzle.com/~aboba/RDMA/draft-ietf-ips-security-10.txt

Franco Travostino, Director Content Internetworking Lab
Advanced Technology
Nortel Networks, Inc.
600 Technology Park
Billerica, MA 01821 USA
Tel: 978 288 7708 Fax: 978 288 4690
email: [email-masked]