Subject: [MSEC] draft-bellovin-useipsec

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 22 Sep 2005 15:14:21 -0700

Folks,

Please read the following text from 
http://www.ietf.org/internet-drafts/draft-bellovin-useipsec-04.txt

7. Broadcast and Multicast

    Although the designers of IPsec tried to leave room for protection of
    multicast traffic, a complete design wasn't finished until much
    later.  There is, as yet, no key management for the general case,
    though MIKEY [RFC3830] will work for peer-to-peer, simple one-to-
    many, and small group multicast.  Worse yet, an important component
    of over-the-wire IPsec -- replay protection -- was designed even
    later [2401bis,2402bis,ESPv3], and is thus unavailable in deployed
    multicast implementations.  IPsec is thus inappropriate for such
    protocols unless and until suitable key management and replay
    protection mechanisms are available in the target domain.

This draft is in IETF last call and is to be published as BCP soon.  I 
wrote my review and complained about the inaccuracies above (I have cc'ed 
MSEC).  Please send your notes on that draft to the IESG and the SEC ADs.

thanks and regards,
Lakshminath 

_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: Mark Baugher <[email-masked]>
Date: Thu, 22 Sep 2005 15:36:37 -0700

Steve, Lakshminath
   Thanks for pointing this out, Lakshminath.  It is not clear to me  
why Steve does not mention the two group key management RFCs that we  
have produced in this working group.  In particular, the RFC 3547  
design is specifically for support of one-to-many IPsec.  I don't  
understand why a peer-to-peer protocol is mentioned but not RFC 3547,  
which was published during Steve's watch as security AD.

Mark
On Sep 22, 2005, at 3:14 PM, Lakshminath Dondeti wrote:

> Folks,
>
> Please read the following text from http://www.ietf.org/internet- 
> drafts/draft-bellovin-useipsec-04.txt
>
> This draft is in IETF last call and is to be published as BCP  
> soon.  I wrote my review and complained about the inaccuracies  
> above (I have cc'ed MSEC).  Please send your notes on that draft to  
> the IESG and the SEC ADs.
>
> thanks and regards,
> Lakshminath
>