Subject: Re: [IPsec] AD re-review of draft-ietf-ipsecme-ad-vpn-problem

From: "Manral, Vishwas" <[email-masked]>
Date: Tue, 9 Jul 2013 22:34:13 +0000

Hi Paul,

I am done with all the changes. I am now waiting for the reviewers to approve the same.

Thanks,
Vishwas

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Monday, May 20, 2013 6:28 PM
To: [email-masked]
Cc: Sean Turner; IPsecme WG
Subject: Re: [IPsec] AD re-review of draft-ietf-ipsecme-ad-vpn-problem

Document authors: when might we have the update so Sean can move this forwards? We are gated on this before we solicit AD-VPN protocols.

--Paul Hoffman

On Apr 30, 2013, at 7:52 AM, Sean Turner <[email-masked]> wrote:

> Please incorporate the QoS issue brought up by Toby.  I'd like to make sure we have everything in the draft that the WG wants before issuing the WGLC.  I also think the TSV/RTG directorates/ADs will be interested in that.
> 
> Can you explain the rationale for the following the changes to requirement #5; I'm just not following it:
> 
> OLD:
> 
> 5. One ADVPN peer MUST NOT be able to impersonate another ADVPN	peer.
> 
> NEW:
> 
> 5. Any of the ADVPN Peers MUST NOT have a way to get the long term
> authentication credentials for any other ADVPN Peers. The compromise of an Endpoint MUST NOT affect the security of communications between other ADVPN Peers. The compromise of a Gateway SHOULD NOT affect the security of the communications between ADVPN Peers not associated with that Gateway.
> 
> Is the first sentence still saying basically: "peers can't impersonate peers"?
> 
> Nits:
> 
> - sec 1.1: Need to add what an ADVPN is and expand the acronym
> 
> - sec 4/1.1: The terms allied and federated environment kind of come out of nowhere.  Please add them to s1.1.  I just to make sure it's clear what the difference is between the two.