Re: draft-ietf-v6ops-cpe-simple-security: filtering encapsulated flows

[Mark Smith <ipng@69706e6720323030352d30312d31340a.nosense.org>]

On Sat, 22 Aug 2009 22:33:37 -0700
james woodyatt <jhw@apple.com> wrote:

> On Aug 22, 2009, at 21:58, Truman Boyes wrote:
> >
> > This is quite confusing from an implementation perspective; security  
> > is not explicitly increased by prohibiting non-encrypted tunnels but  
> > allowing encrypted (ESP or AH) traffic flows. Wouldn't this simply  
> > serve as a driver to make all tunnel encapsulations use ESP/AH?
> 
> Yes.  I'm not sure I can explain how this is supposed to increase  
> security, but if consensus in the working group emerges around these  
> recommendations and the draft can proceed through working group last  
> call, then that's good enough for me.
> 

Maybe I haven't fully understood the question, however isn't the answer
as simple as the benefits of IPsec over cleartext? Even the
better-than-nothing-mode of IPsec, while vulnerable to
man-in-the-middle attacks during session setup, has a much smaller
window of opportunity for exploitation over clear text traffic.

Regards,
Mark.