Subject: [Ipsec] IPsec support

From: Noel Keith <[email-masked]>
Date: Sat, 10 Jun 2006 01:00:35 +0000 (GMT)

Hello All:

I´d like to know if i use IPsec(only transport mode
with ESP and AH) i need that my routers supports IPsec
or just my Media Gateway Controller and Media Gateway.

Cheers,

Noel

__________________________________________________
Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis! 
¡Abrí tu cuenta ya! - http://correo.yahoo.com.ar

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Mon, 12 Jun 2006 10:43:01 -0400

>or just my Media Gateway Controller and Media Gateway.

only the endpoints (e.g., the MGC and MG) need to 
be aware of IPsec use in this context, not the 
intermediate routers.

Steve

---

From: Subha Venkataramanan <[email-masked]>
Date: Mon, 12 Jun 2006 15:02:38 -0700 (PDT)

Hi List-members,

Recently I came across some information that there are
Certicom and Microsoft related patent issues with
respect to IKE.

Has anyone in the list gone through them, and are they
valid?

Certicom IPR has claims on DH Group weak key detection
method. Microsoft patent relates to NAT-Traversal
(port float). I haven't gone through the patent in
details.

Has anyone gone over it, and would like to share some
information on the same ?

Thanks,
Subha 

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

---

From: Scott Fluhrer <[email-masked]>
Date: Tue, 13 Jun 2006 05:33:06 -0700 (PDT)

On Mon, 12 Jun 2006, Subha Venkataramanan wrote:

> method.

I have gone through it.  I am not a lawyer, but it appeared to me to be 
totally spurious, at least as IKE is concerned.  Their relevant patents 
were about ways to detect if the peer sent you a DH public value from a 
small subgroup (which an attacker might use in an active attack scenario). 
In the MODP DH groups that IKE uses, this amounts to comparing the 
received value against the value 1 (as there are no other subgroups of the 
group that IKE uses [1]).  In the ECC DH groups that IKE uses, I believe 
this amounts to comparing the received value against the point at 
infinity, for the same reason.  However:

- The IKE RFCs never mandate (or even mention) such a check
- This check is not required for security, as IKE has other methods of
   detecting if an active attacker modifies the DH public value in an
   IKE packet.

>          Microsoft patent relates to NAT-Traversal