Subject: RE: FW: draft response #14 - security

From: [email-masked]
Date: Thu, 19 Aug 1999 00:14:50 +0300

I think you suggest a good alteration on my response.
If a transport offers a transparent security mechanism,
then it makes sense to use it.  Otherwise, folks can use the
IP encapsulation.  For GSMP over IP, IPSec will probably end up the mandate,
though this has not been decided yet.

In terms of the ATM security mechanism:  does it involve any changes in
GSMP, or is it something taken care in the setup of the connection?

a.

-----------------------------------
avri doria
+1 617 678 9402

> -----Original Message-----
> From: EXT Joachim Buerkle [mailto:[email-masked]]
> Sent: 18 August, 1999 8:23 AM
> To: [email-masked]
> Subject: Re: FW: draft response #14 - security
> 
> 
> [email-masked] wrote:
> 
> > -----Original Message-----
> > From: Doria Avri (NTC/Boston)
> > Sent: 15 August, 1999 2:46 PM
> > To: [email-masked]'
> > Subject: RE: draft response #14 - security
> >
> > > -----Original Message-----
> > > From: EXT Joachim Buerkle [mailto:[email-masked]]
> > > Sent: 14 August, 1999 6:27 PM
> > > To: [email-masked]; [email-masked]
> > > Subject: Re: draft of draft-ietf-gsmp-msf-response-00.txt
> > >
> >
> > > >>Requirement #14:
> > > The SCI shall allow for secure
> > > communication between VSC and
> > > VS using a standards based security protocol
> >
> > > >>GSMPv3 compliance:
> > > PE. requirement believed to be
> > > satisfied. The level of
> > > security is a subject for discussion in several IETF working
> > > groups. The issue is
> > > addressed to the IESG to be resolved. A mechanism has been
> > > suggested with the group
> > > that may not be adequate for IETF security purposes.  It is
> > > possible that use if
> > > IPSec will be mandated for security purposes.
> > >
> > > Q: Can somebody please provide also a statement for the
> > > transport via ATM?
> >
> > I think the position of the GSMP WG is that if one wants to 
> use security
> > mechanisms, then they use the IP encapsulation, even if they are
> > operating over ATM.
> 
> As far as I understand the ATM Forum "ATM Security 
> Specification Version 1.0",
> AF-SEC-0100.000, Feb 1999,
> (ftp://ftp.atmforum.com/pub/approved-specs/af-sec-0100.000.pdf
) it didn't
affects the transport of GSMP, i.e. after the authentication for ATM
Security,
GSMP will be transported transparent via AAL5.

"For data integrity, a cryptographic checksum and a sequence number
(optional)
are appended to AAL5 service data units (SDUs)."

So I want to suggest that we allow this also.

Joachim

---

From: Joachim Buerkle <[email-masked]>
Date: Fri, 20 Aug 1999 08:55:16 -0400

Hi Avri,

I got told, from ATM Forum participants, that it is something taken care during
connection setup and that it in their view no changes for GSMP are involved.

If you want I can send a mail to the ATM Forum Security Mailing list to ask also
them.

Joachim

-=-=-=-=-=-=-=-=-=-=-=-=-=-