Subject: [RESEND] some commends on ipsec-01.txt

From: Michael Richardson <[email-masked]>
Date: Tue, 15 Jul 2003 09:36:01 +0200

To: SEND WG <[email-masked]>
Subject: some commends on ipsec-01.txt
Mime-Version: 1.0 (generated by tm-edit 1.8)
Content-Type: text/plain; charset=US-ASCII
Date: Mon, 14 Jul 2003 07:47:44 +0200
Message-ID: <[email-masked]>
From: Michael Richardson <[email-masked]>

-----BEGIN PGP SIGNED MESSAGE-----

okay, so I read the draft finally, last night. I look forward to talking
about it this morning.

These represent a bunch of comments, not all as important as each other.
Also, I haven't implemented ND ever myself, so I glazed over on some 
things that seemed overly detailed to me.

6.5   I see that you specify Authorization Certificates. This is neat.
      I didn't realize that a document had actually specified how to
      do them already. Since I don't know any software that actually
      can deal with, I see this as being a major PITA for people actually
      trying to deploy this. This is a very practical comment.

      Probably some examples (including private keys) would be good.

6.6	s/AltSubjectName/SubjectAltName/ ??

7.1.2	I'd sure like to keep X.509 GOOP out of my VoIP phone.

	I don't want to open an X.509 war. I will express my total lack of
	enthusiasm for building ASN.1 processing into ICMPv6.

7.1.2	need to have an example of a signed packet!

	I'm scared that the ASN.1 that is shown will scare some implementors
	into putting entire, general ASN.1 parsers into their kernels. I
	suggest that an appendix map this ASN.1 to real DER bits-and-bytes,
	such that it is clear what one really has to implement.

7.1.4	miliseconds since Unix epoch.
	Better, I think, would be to have 1/65536s. I.e. standard seconds
	since epoch * 64K. Systems that do not keep milisecond counters,
	can just time()<<16. Many systems have 1/100s counters, etc. 

	This isn't a big deal, but something that jumped out at me. I mean,
	we are doing RSA validation, so a 64-bit multiply shouldn't scare us.

10.1	how does the router form two sets of link-local addresses?
	an example would be appreciated.
	This probably just shows my IPv6 address architecture ignorance,
	but I'm probably not the only one.

11.	While hosts may not have to lots of operations, routers may
	have to do a lot. While it may seem unlikely that an IPv6 network
	will be subject to a host-scan (all 2^64 hosts...) that doesn't
	that script kiddies won't try this, or even understand how big
	2^64 is. 

	Slightly smarter ones might to try, for instance, to find all devices
	from a particular manufacturer that are on a link. If know the IEEE
	OUI assigned to that manufacturer..
	This is a much smaller,	2^24 space. 

	As such, I think that the router will do a *LOT* of work here.
	You mention pre-computing some pieces, but I think that some
	more details are needed.

12.	I do not see how BITS can cope - it has to be integrated.

]                   At IETF57 in Wien, Austria                  |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] printk("Just another Debian GNU/Linux using, kernel hacking, security guy");[

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------