Re: Status of Seamoby drafts

Jim,

> draft-ietf-ctp: OPS AD Dave Kessens had some major Discuss comments about
> the lack of detail in the definition of how IKE is used, and lack of
> discussion of "correctness" such as in draft-ietf-eap-keying. I'm currently
> working with Dave and Allison to resolve the Discuss.

I looked up the security comments from the OPS directorate.
https://datatracker.ietf.org/public/pidtracker.cgi?command=print_ballot&ballot_id=839&filename=draft-ietf-seamoby-ctp

> For example, Section 6.2 talks about using of IKE to dynamically negotiate
> keys for protection of Inter-Router traffic.  However, it doesn't say what
> IKE modes need to be implemented, or what IPsec ciphersuites are required.

this doesnt make a lot of sense to me.

we can only say that there must be confidentiality protection
for the secure channel between the access routers. we also say
ESP in transport mode must be used. we also say a non-null
encryption algorithm is to be used.

implementations have to follow IPsec specifications.

http://www.ietf.org/internet-drafts/draft-ietf-ipsec-ikev2-algorithms-05.txt
specifies what algorithms to use with IKE.

http://www.ietf.org/internet-drafts/draft-ietf-ipsec-ui-suites-06.txt
specifies what cryptographic suites to use with IPsec.

CTP actually doesnt care which cipher suites or algorithms from
the above two drafts are used as long as the requirements for
non-null encryption algorithm, authentication, and confidentiality
protection is achieved.

> Since context transfer security is an n by n problem, establishing the SAs
> to protect inter-router transfers is not an easy thing.  For this reason one
> might conclude that pre-shared keys are difficult, since n(n-1) of them
> would be necessary.  On the other hand, is it being suggested that each
> router needs to be provisioned with a certificate? On reading the draft it
> isn't clear what's being recommended (or even considered).

this comment is valid. but since we assume the access routers are
part of the same administrative domain, they are provisioned with
the required certificates to run IKE. (?)

Vijay