Subject: [MSEC] draft-ietf-msec-ipsec-signatures-02.txt

From: Brian Weis <[email-masked]>
Date: Mon, 11 Oct 2004 08:39:03 -0700

Thanks to all who had comments on the IPsec signatures draft during the 
WG last call. The next version of the draft has just been posted to the 
I-D repository. Please take a look to see if the changes adequately 
reflect the discussion.

http://www.ietf.org/internet-drafts/draft-ietf-msec-ipsec-signatures-02.txt

Here's a summary of changes:

- Various grammar fixes and updating of references

- Section 2: Clarification on key lifetimes, and the use of ephemeral key
  pairs.

- Section 3: Correction of the minimum key size (to match the stated 
minimum in
  section 2)

- Section 3: Addition of the note that a low-exponent RSA (e.g., 3) may
  increase performance, and there are no known attacks on low-exponent RSA
  with this usage. (At least, I couldn't find any in the literature and 
when I
  posted a query to the CFRG mailing list no one responded with a known
  attack.)

- Section 5: Added clarification text as to why it is not recommended that
  this transform be used with pair-wise SAs.

- Section 6: Added a paragraph noting that non-repudiation is not claimed by
  this draft, and explaining why.

- Section 6.7: Clarified that the anti-DoS mitigation of encapsulating the
  IPsec transform with another transform using an HMAC is not effective
  against attackers that are part of the group.

Thanks,
Brian

-- 
Brian Weis
Advanced Security Development, Security Technology Group, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]

_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec