Subject: RE: [mobile-ip] Any other security other than IPSec?

From: "Tan, Tat Kin" <[email-masked]>
Date: Tue, 5 Aug 2003 08:25:54 +0800

-----Original Message-----
From: Uri Blumenthal [mailto:[email-masked]]
Sent: Tuesday, August 05, 2003 12:31 AM
To: Tan, Tat Kin
Cc: [email-masked]
Subject: Re: [mobile-ip] Any other security other than IPSec?

On 8/2/2003 2:17 AM, Tan, Tat Kin wrote:
> Hello,
> 
> Would like to know if anyone had ever consider to implement or had any
> idea to use other security measurements in mipv6 instead of the much
> talked IPSec?
> While the draft indicated most of the communications SHOULD use IPSec,
> such as during binding, i was thinking performance would be a huge
> factor under processing bandwidth hunger area such as real time
> voice processing.

IPsec provides two things:

1. Establishes session keys for the traffic.
2. Authenticates and/or encrypts every traffic packet.

First - what makes you think that performance on a per-packet basis
will suffer by "a huge factor"? Do you have any numbers...?

TK : Correct me if i m wrong, that IPSec is more like a combination of encryptions methods and both parties that wants to use IPSec will have to talk to each other to negotiate a set or a few and depends on the priority. Every MN/CN would have different IPSec's combinations. Would that be extra overhead to process? would there be other alternative solution? I dont know. that's why i m asking. And a gentleman name Jari Arkko has answered my question. kindly have a read at his comment.

Second - if you abolish IPsec but decide you still need security,
you will have to perform both of the above steps. Please tell me
what makes you think that doing those things by other-than-IPsec
tool is any faster or easier on performance. (A hint: crypto
operations are the same, crypto algorithms are the same.)

TK : Again alternative solution might be available. one question everyone is interested in knowing is that, will the alternative solution provide better security system or worst? I will let you know when i have a solution. Hint : They all laugh at christopher columbus when he says the world is round ...

:)

---

From: Uri Blumenthal <[email-masked]>
Date: Tue, 05 Aug 2003 02:52:37 -0400

On 8/4/2003 8:25 PM, Tan, Tat Kin wrote:
> Correct me if i m wrong, that IPSec is more like a combination of
> encryptions methods

OK, correcting.

IPsec consists of two parts.

Part One - ascertaining that the other party is who it claims it is,
and then agreeing upon what (if any) authentication and encryption
algorithm will be used. And deriving the keys for them.

Part Two - encrypting and/or authenticating the actual IP traffic.

> and both parties that wants to use IPSec
> will have to talk to each other to negotiate a set or a few and
> depends on the priority.

The parties don't HAVE to negotiate - it can be preconfigured,
or simply forced by the security policy at both ends. They CAN
negotiate, if it's allowed. In the end there's only one crypto
algorithm for each crypto function.

Anything wrong with the ABILITY to negotiate?

>  Every MN/CN would have different IPSec's combinations.

First - there are only a few possible algorithms to choose from.
Second - it is up to the administrator to allow all of them, one
of them or none of them. How is it a problem?

> Would that be extra overhead to process?

In what sense? An extra overhead to negotiate what algorithms to
use? Not really - done ONCE in the beginning of the session. A
couple of extra packets to cross the wire. Peanuts.

>  would there be other alternative solution?

Like what? You can either negotiate what algorithm to use, or
pre-configure (force) the algorithm.  What other alternatives
can there possibly be?!

> Again alternative solution might be available.

Alternative in what sense? Are you planning to perform encryption
and/or authentication on a per-packet basis, or not? If you are,
then there's no reason to expect that you can do it with fewer
expenses than IPsec.  If you do have reasons to expect better
performance from "alternative" crypto - please share those
reasons with us here and now.

> one question everyone is interested in knowing is that, will
> the alternative solution provide better security system or
> worst?

Considering the security expertise of those who seem to be
searching for an "alternative solution" I don't expect it
to be better. Not to mention that you don't seem to offer
a clue regarding what component(s) of IPsec you're seeking
an alternative for. What do you want to change and why?

> I will let you know when i have a solution. Hint : They all
> laugh at christopher columbus when he says the world is round ...
> :)

Excessive modesty doesn't seem to be the problem here. :-)

Anyway, reinventing the wheel is much more common in the
history of science than successful circumnavigation, and
people laugh at it [the re-invented wheel] much harder.