Subject: Re: [midcom] R65

From: Melinda Shore <[email-masked]>
Date: Thu, 11 Oct 2001 17:13:52 -0400

At 01:45 PM 10/11/01 -0700, Anderson, Todd A wrote:
>It seems to me that you wouldn't want somebody to be able to
>capture an open or close pinhole/NAT binding request and play it
>back at some arbitrary point in the future.  

We've talked about anti-replay protect in the context of the
framework document but we don't have any requirement text
covering it.  I do think we need something.  I'd personally
rather see a separate requirement - I don't think that all
security-related requirements should be lumped together as 
one - but it's up to the discretion of the working group.
Whichever way we go let's get it settled by tomorrow
afternoon EDT.

Melinda

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: "Christopher A. Martin" <[email-masked]>
Date: Mon, 15 Oct 2001 09:40:46 -0500

This is true, and this one actually falls into an authentication security
category...perhaps .

Possibly via SSL/TLS or some other means of transporting the MIDCOM protocol
traffic.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Melinda Shore
> Sent: Thursday, October 11, 2001 4:14 PM
> To: midcom
> Subject: Re: [midcom] R65
>
>

---

From: Melinda Shore <[email-masked]>
Date: Mon, 15 Oct 2001 10:49:18 -0400

>This is true, and this one actually falls into an authentication security

We'd talked about how to represent time increments, etc.  At any
rate we're not going to be requiring mechanisms, so let's get a
new requirement in there:

Rxx: The midcom protocol must provide protection against replay
  attacks.

Melinda