RE: Review of -10 security draft

[Franco Travostino <travos@nortelnetworks.com>]

At 12:30 PM 2/20/2002, Ernest Dainow wrote:

> Can you confirm that draft 10
> removes the requirement that every TCP
> connection must have a separate IKE Phase 2 SA? 
>
> Some sections of the document seem to have been modified to reflect
> this,
> but I did notice an exception, in Section 1.2 (iFCP) "Each IPsec
> SA
> established by IKE protects a single TCP
> connection".

Good catch. Sections 1.2, 4.2, and the iFCP document still need to absorb
this change in full. We will need an additional pass (10 for iFCP, and 11
for the security draft) to achieve full consistency across the
board.

thanks,
-franco


> If this requirement
> has in fact been removed, it needs to be removed from
> the other draft documents, such as FCIP and iSCSI.
>
>
> -----Original Message-----
> From: Joseph D. Harwood
> [mailto:jharwood@vesta-corp.com]
> Sent: Wednesday, February 20, 2002 11:02 AM
> To: Bernard Aboba; Ernest.Dainow@mcdata.com
> Cc: ips@ece.cmu.edu
> Subject: RE: Review of -10 security draft
>
>
>
>
> > -----Original Message-----
> > From: Bernard Aboba
> [mailto:bernard_aboba@hotmail.com]
> > Sent: Tuesday, February 19, 2002 2:42 PM
> > To: jharwood@vesta-corp.com; Ernest.Dainow@mcdata.com
> > Cc: ips@ece.cmu.edu
> > Subject: Review of -10 security draft
> >
> >
> > >How does requiring each connection to have its own Phase 2
> SA
> > mitigate >the
> > >vulnerability in this scenario?
> >
> > IPsec doesn't protect against this at all, and the text needs
> to
> > make this
> > clear.
> >
> > Please take a look at the latest -10 security draft in progress to
> see if
> > this addresses the issue:
> >
> >
> http://www.drizzle.com/~aboba/RDMA/draft-ietf-ips-security-10.txt
> >
>
> It does, thanks!
>
> Best Regards,
> Joseph D. Harwood
> (408) 838-9434
> jharwood@vesta-corp.com
> www.vesta-corp.com

Franco Travostino, Director Content Internetworking Lab
Advanced Technology
Nortel Networks, Inc.
600 Technology Park
Billerica, MA 01821 USA
Tel: 978 288 7708 Fax: 978 288 4690
email: travos@nortelnetworks.com