[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: CGA Use with HBA in Shim6 IETF Meeting July 10, 2006
You and I are disagreeing on where the market is going to go technically. I don't think we will compromise or that we can converge. So trying to save a lot of email here.
What we need the working group to discuss now is how much and when do we worry about the market doing our engineering/scientist work to identify a protocol. I could provide quite a few examples from good IETF work that is RFC that might never be deployed in production. Also as I said SHIM6 will not be pervasive for at least 5 years in the market and we have time to think there is no rush here at all.
/jim
> -----Original Message-----
> From: marcelo bagnulo braun [mailto:marcelo@it.uc3m.es]
> Sent: Wednesday, July 19, 2006 3:20 PM
> To: Bound, Jim
> Cc: shim6@psg.com; Pekka Savola; Iljitsch van Beijnum
> Subject: Re: CGA Use with HBA in Shim6 IETF Meeting July 10, 2006
>
>
> El 19/07/2006, a las 20:01, Bound, Jim escribió:
>
> > I don't agree it is huge deployment obstacle,
>
> i guess e need to agree to disagree here.
>
> I certainly think that requiring certificates issued by a
> global PKIto all the nodes running shim6 is a huge deployment obstacle
>
> what do others think? does it seems an acceptable apporach to base
> shim6 security in the availability of certificates issue by a
> global PKI in all shim6 peers?
>
> > but if it was it is not our issue here in IETF WG.
>
> yes it is. because if we propose a protocol that relies on
> tools that require massive dpeloyment cost, then the protocol
> is likely to not be deployed so it is a poor solution. As
> engineers, we need to provide deployable solutions i.e
> solutions with a reduced deployment costs (in other words,
> the deployment cost is a factor to be taken into account when
> evaluating different solutions)
>
>
> > Biometric, Smartcards, LinkIDs can all be preshared and
> associated
> > with enclaves per the other thread on end-to-end PKI.
> >
>
> i am not sure what do you mean here, but i am afraid that of
> all these abve, only preshared secret and global pki could be
> used to secure the shim... i don't think biometrics or
> smarcards can help here..
>
>
> regards, marcelo
>
>
>
> > /jim
> >
> >> -----Original Message-----
> >> From: marcelo bagnulo braun [mailto:marcelo@it.uc3m.es]
> >> Sent: Wednesday, July 19, 2006 11:28 AM
> >> To: Bound, Jim
> >> Cc: shim6@psg.com; Pekka Savola; Iljitsch van Beijnum
> >> Subject: Re: CGA Use with HBA in Shim6 IETF Meeting July 10, 2006
> >>
> >>
> >> El 19/07/2006, a las 16:52, Bound, Jim escribió:
> >>
> >>> Hi Marcello,
> >>>
> >>> Well my view is specs cannot make assumptions about market
> >> deployment
> >>> the question first to ask is would IPsec work.
> >>
> >> i agree with this
> >>
> >> however, it is imho completelly valid to evaluate
> different solutions
> >> based on their deployment costs.
> >>
> >> A solution based on IPSec requires either pre shared keys
> between all
> >> the nodes in the internet or certificates for all the nodes of the
> >> internet. This is a huge deployment obstacle. So this
> solution does
> >> present this problem and needs to be taken into account when
> >> evaluating different solutions. A solution that does not requires
> >> this would require less deployment effort. Of course this
> is not the
> >> only (or even most important) consideration when evaluating
> >> alternative solutions but it is indeed an important
> element imho, do
> >> you agree?
> >>
> >> regards, marcelo
> >>
> >>
> >>> None of us have a crystal ball and our engineering work here is
> >>> usually focused on the protocol behavior and that it does
> >> no harm and
> >>> does not cause interoperability problems.
> >>>
> >>> /jim
> >>>
> >>>> -----Original Message-----
> >>>> From: marcelo bagnulo braun [mailto:marcelo@it.uc3m.es]
> >>>> Sent: Wednesday, July 19, 2006 5:57 AM
> >>>> To: Bound, Jim
> >>>> Cc: shim6@psg.com; Pekka Savola; Iljitsch van Beijnum
> >>>> Subject: Re: CGA Use with HBA in Shim6 IETF Meeting July 10, 2006
> >>>>
> >>>> Hi Jim,
> >>>>
> >>>>
> >>>> El 11/07/2006, a las 17:25, Bound, Jim escribió:
> >>>>
> >>>>> I see this point. Clearly public or pre-shared PKI has to
> >>>> exist yes.
> >>>>> But enclaves of network users will have this association is the
> >>>>> assumption. So if we are not in some enclave we would
> >> need to join
> >>>>> one to send each other files via IPsec with encrypt. The
> >>>> enclaves are
> >>>>> being built now.
> >>>>
> >>>>
> >>>> As i understand it, the only way to make the shim6
> >> security based on
> >>>> IPSec is to assume that a global PKI is deployed,
> including client
> >>>> certificates (i.e. not only server
> >>>> certificates) so that it is possible to secure any-to-any
> >>>> communication.
> >>>>
> >>>> From what i understand such global pki is not in place
> yet and it
> >>>> doesn't looks like it will be anytime soon if ever.
> >>>>
> >>>> So, i really don't think it is reasonable to build the
> security on
> >>>> the
> >>>> shim6 relying on such global pki deployment
> >>>>
> >>>> does anybody think that it would be acceptable to build the
> >>>> shim6 security based on the assumption of a global PKI
> deployment?
> >>>>
> >>>> Regards, marcelo
> >>>>
> >>>>
> >>>>>
> >>>>> Sorry I missed your point.
> >>>>>
> >>>>> /jim
> >>>>>
> >>>>>> -----Original Message-----
> >>>>>> From: Iljitsch van Beijnum [mailto:iljitsch@muada.com]
> >>>>>> Sent: Tuesday, July 11, 2006 10:19 AM
> >>>>>> To: Bound, Jim
> >>>>>> Cc: Pekka Savola; shim6@psg.com
> >>>>>> Subject: Re: CGA Use with HBA in Shim6 IETF Meeting
> July 10, 2006
> >>>>>>
> >>>>>> On 11-jul-2006, at 10:13, Bound, Jim wrote:
> >>>>>>
> >>>>>>> IPsec is deployed end-to-end for v4 and v6 in production
> >>>> not sure I
> >>>>>>> agree no one knows how to do this and I think I
> >>>> misunderstood your
> >>>>>>> statement below? Thanks.
> >>>>>>
> >>>>>> So if I want to send you a file and I want to encrypt it
> >>>> with IPsec,
> >>>>>> how do I do that, without making special arrangements first?
> >>>>>>
> >>>>>> IPsec is only used for VPN tunnels in practice today.
> >>>>>>
> >>>>>
> >>>>
> >>>>
> >>>
> >>
> >>
> >
>
>