Subject: RE: [tcpm] new internet draft - drafft-touch-anonsec

From: [email-masked]
Date: Thu, 6 May 2004 15:43:50 -0500

> -----Original Message-----
> From: ext Christian Huitema [mailto:[email-masked]]
> Sent: Thursday, May 06, 2004 3:41 PM
> To: Swami Yogesh (Nokia-NRC/Dallas); [email-masked]; [email-masked]
> Subject: RE: [tcpm] new internet draft - drafft-touch-anonsec
> 
> 
>  
> > i.e., Trudy sends a packet with her SPI (SPI2) to Alice, but in the
> inner
> > packet she sends a packet which has IP address of Alice and Bob and
> TCP
> > ports of Alice and Bob. Please also note that Trudy can use just one
> SPI2
> > to attack hundreds of TCP connection that might originate 
> from Alice.
> 
> What you are saying is that one cannot really protect TCP with
> tunnel-mode IPSEC. Duh. Use transport mode.
> 

But that's a very restrictive policy decision, isn't it?

Yogesh

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 6 May 2004 13:52:07 -0700

> But that's a very restrictive policy decision, isn't it?

Well, you are supposed to choose a policy that creates the adequate
security result. So clearly, there is a restriction against inadequate
policies...

-- Christian Huitema