Subject: RE: Review of -10 security draft

From: "Joseph D. Harwood" <[email-masked]>
Date: Wed, 20 Feb 2002 08:01:47 -0800

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]]
> Sent: Tuesday, February 19, 2002 2:42 PM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: Review of -10 security draft
>
>
> >How does requiring each connection to have its own Phase 2 SA
> mitigate >the
> >vulnerability in this scenario?
>
> IPsec doesn't protect against this at all, and the text needs to
> make this
> clear.
>
> Please take a look at the latest -10 security draft in progress to see if
> this addresses the issue:
>
> http://www.drizzle.com/~aboba/RDMA/draft-ietf-ips-security-10.txt
>

It does, thanks!

Best Regards,
Joseph D. Harwood
(408) 838-9434
[email-masked]
www.vesta-corp.com

---

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 20 Feb 2002 10:39:09 -0800

>Can you confirm that draft 10 removes the requirement that every TCP
>connection must have a separate IKE Phase 2 SA?

That's the intent, yes.

>Some sections of the document seem to have been modified to reflect >this, 
>but I did notice an exception, in Section 1.2 (iFCP) "Each IPsec >SA 
>established by IKE protects a single TCP connection".

Thanks for finding this. I'll remove that one too.

>If this requirement has in fact been removed, it needs to be removed >from 
>the other draft documents, such as FCIP and iSCSI.

Yes. Once we've finished with -10, we will probably need another sync up.

_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com

---

From: "Bernard Aboba" <[email-masked]>
Date: Sat, 23 Feb 2002 14:18:28 -0800

The latest -10 draft corrects the problem in section 1.2 with mandating 
single SA per TCP connection. It also addresses the DHCP/IPsec issue, as 
well as the performance concerns that have been raised. Comments welcome.

_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com