Subject: Re: [lisp] To IPsec or not IPsec (Issue #2)?

From: [email-masked] (Noel Chiappa)
Date: Tue, 22 Sep 2009 23:45:29 -0400 (EDT)

> From: Brian Weis <[email-masked]>

    > "IPSec is not a good fit for this application." ...
    > All that seems wanted for the Map-Server is a packet integrity method
    > ...
    > Would there be support for replacing the use of AH with a simple
    > Authentication Data field in the Map-Register packet? Defining one or
    > more MACs and their usage for this protocol can be straightforward.

Sounds good to me, although we might want to do something about replay.

Maybe we could add a timestamp type field, and initial implementations could
leave it blank -> no replay protection; later on we can add protocol
mechanism (a packet exchange) to allow us to do that?

    > Key management would most certainly be restricted to manually shared
    > keys for now, but it can be automated if and when a generalized
    > automated key management method for routing is defined.

Right, it's a logically separate protocol, so we can come along and add that
later.

(We can't do everything before everything else, we have to order things, and
this seems like more of an O+M issue than something we have to solve Right Now
to start field trials.)

	Noel