Subject: Re: Results of protocol straw poll

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 07 May 2001 10:56:02 -0400

In message <[email-masked]>, "Maso
n, David" writes:
>The purpose of IKE is to provide internet authentication and key exchange.
>I never understood why support for remote access requirements should be
>excluded from it.  Fulfilling remote access requirements adds complexity.
>What's the logic behind dividing that support (and complexity) between four
>entities (IKE, legacy system, CA, and new protocol) being more secure than
>doing it between three entities (IKE, legacy system, and CA)?

The rationale for ruling out changes to IKE is not abstract; rather, 
it's that IKE is too complex already, and adding more stuff to it will 
make it much worse.

It's always an engineering tradeoff to decide when to add new modules; 
I'll assert that for the last 25 years, the bulk of computer science 
opinion has been that composing simple building blocks is a better idea 
than building monolithic, complex ones.

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: "Scott Fanning" <[email-masked]>
Date: Mon, 7 May 2001 08:37:32 -0700

I thought IKE (ISAKMP) was a framework?

From RFC 2408

  "ISAKMP is designed to provide a
   flexible and extensible framework for establishing and managing
   Security Associations and cryptographic keys.  The framework provided
   by ISAKMP consists of header and payload definitions, exchange types
   for guiding message and payload exchanges, and general processing
   guidelines.  ISAKMP does not define the mechanisms that will be used
   to establish and manage Security Associations and cryptographic keys
   in an authenticated and confidential manner.  The definition of
   mechanisms and their application is the purview of individual Domains
   of Interpretation (DOIs)."

Notice the word "extensible".

So, maybe remote access should be its own DOI?

I agree with Steve that the reduction of complexity is an important goal,
especially in the world of security. However, I would argue that if we got
rid of the vague descriptions of rekeying, Phase 1 lifetime negotiation (or
lack of it), and commit bit fun, I am sure there would be room for the
complexity of a remote access mode.

My two cents.

Scott

----- Original Message -----
From: "Steven M. Bellovin" <[email-masked]>
To: "Mason, David" <[email-masked]>
Cc: "'Ari Huttunen'" <[email-masked]>;
<[email-masked]>; <[email-masked]>
Sent: Monday, May 07, 2001 7:56 AM
Subject: Re: Results of protocol straw poll