Subject: requirements draft - suggested additions

From: "Scott G. Kelly" <[email-masked]>
Date: Tue, 03 Jul 2001 09:29:00 -0700

Hi All,

I am (finally) performing the edits resulting from wg last call on the
requirements draft, and it occurs to me that something is lacking.
However, given that last call has occurred, I thought I should check
with everyone before making any additions. In section 2 (General
Solution Requirements), there is a list of 6 requirements:

o should provide direct support for legacy user authentication
  systems such as RADIUS 

o should encourage migration from existing low-entropy
  password-based systems to more secure authentication systems

o if legacy support cannot be provided without some sort of
  migration, the impact of such migration should be minimized

o user authentication information must be protected against
  eavesdropping and replay (including the user identity)

o single sign-on capability should be provided in configurations
  employing load-balancing and/or redundancy

o n-factor authentication mechanisms should be supported

I think we should add the following:

o Security gateway vulnerability to DoS attacks should be
  minimized, and if possible, should not be greater than the
  vulnerability which exists in SGW systems not providing remote
  access

o The chosen mechanism(s) should minimize any reduction in the
  baseline security of the underlying IPsec connection (when 
  compared with the unselected mechanisms)

Does anyone object to either of these?

Scott