RE: IPsec and RDDP as a transport

> If one shot STags would have been an acceptable solution,
> why wouldn't making one shot STags a "MUST implement"
> be adequate?

Because that would allow long-lived STags without requiring
the countermeasures for the security exposures they create.
 
[... snip ...]

> I also repeat my objection to requiring that a cleanly layered
> RDDP implementation solve problems on a lower layer.
> This is *extremely* bad policy. The SCTP mapping in particular
> is quite suitable for implementation *over* SCTP.

That's fine - see below for an approach that solves RDDP's problems
within the RDDP layer ...
 
> The probable effect of forcing inclusion of IPsec in an RNIC

[... snip ...]

This is going off on an unproductive tangent.  Please reread
the following from my earlier post:

  Given the resistance to a "MUST implement IPsec" requirement,
  the only obvious remaining path forward is to design security
  mechanisms into the RDDP protocols (i.e., solve the security
  exposures created by RDDP headers with long-lived STags without
  resorting to IPsec). To a first approximation, the security
  mechanisms will have to be able to address the following:

	If an attacker hijacks a transport connection and
	attempts to make use of an existing STag, the attempt
	will fail because <put details of security mechanism
	here>.

I believe this is an alternative to "MUST implement IPsec", but
it will take some significant work to design the new security
mechanisms for the RDDP headers.  While I can't speak for the
security ADs, my working assumption (and intent in writing the
above text) is that these security mechanisms can be confined to
the RDDP headers (i.e., it will not be necessary to MAC or encrypt
the payloads to be placed).

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email protected]        Mobile: +1 (978) 394-7754
----------------------------------------------------