Subject: [Ipsec] a new draft

From: "Souhwan Jung" <[email-masked]>
Date: Tue, 20 Jul 2004 05:44:10 +0900

Dear all,

I apologize if you got this meessage twice.

We have submitted a draft related to multiple senders that shares a SA.
The main focus is to solve the problem of sequence number problem. 
Any comments on the draft will be appreciated. 

http://www.ietf.org/internet-drafts/draft-zhao-ipsec-multi-sender-sa-00.txt

Thanks.

Souhwan
============================================================
Souhwan Jung
Associate Professor                      email:[email-masked]
School of Electronic Engineering     phone: +82-2-820-0714
Soongsil University                         fax: +82-2-821-7653
1-1 Sangdo-dong, Dongjak-ku, 
Seoul 156-743
============================================================

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Yoav Nir" <[email-masked]>
Date: Wed, 21 Jul 2004 10:18:30 +0300

Hi.

As you state in section 3.5.2, there is a requirement for the IV to be
unique within the lifetime of the key.

Suppose we are using 3DES-CBC, and replacing the key after 1,000,000 IP
packets have been sent.  If you generate the full 64-bit IV randomly, the
chances of a collision (two IVs being identical) are 0.0000027%.  That's low
enough that most of us will accept the risk.
If we fix 16 bits of the IV, and generate only 48 random bits, then the
likelihood of a collision rises to 0.177%, which may very well be
unacceptable to many.

With AES-CBC, this is not a problem, as 112 bits of randomness are plenty.

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Souhwan Jung
Sent: Monday, July 19, 2004 11:44 PM
To: [email-masked]
Subject: [Ipsec] a new draft 

Dear all,

 
 
Thanks.

Souhwan

---

From: Brian Weis <[email-masked]>
Date: Mon, 26 Jul 2004 14:40:47 -0700

Hi,

You mention IKE a few times in the I-D, but IKE cannot be used to
provide group keys to devices. The MSEC working group has specifications
for group key management methods, including RFC 3547.

Also, you reference RFC 2401. You should be aware of
draft-ietf-ipsec-rfc2401bis-02.txt, which has some additional
clarification on using IPsec for multicast traffic.

I suggest you send an email to [email-masked] asking for comments on
your multiple sender SA draft.

Brian

Souhwan Jung wrote:

>------------------------------------------------------------------------
>

-- 
Brian Weis
Advanced Security Development, ITD, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]