Subject: [Mip6] [issue83] secdir review of draft-ietf-mip6-ikev2-ipsec-07.txt

From: admin <[email-masked]>
Date: Wed, 15 Nov 2006 20:26:39 +0000

New submission from admin <[email-masked]>:

This is a security directorate review of
draft-ietf-mip6-ikev2-ipsec-07.txt.  Were I still an AD, I'd DEFER it,
since to evaluate it properly I'd need to reread 3775 and 3776, and I
don't have time to go through 200 pages more right now...

One obvious problem: Section 4.1 notes that 3775 requires support for
manual key management, and lists IKE support as a "MAY".  However, 4107 --
a BCP which came out after 3775 -- establishes a strong presumption that
automated key management automated key management be used.  Accordingly,
this draft should mandate support for IKEv2, as it does not appear to fall
under any of the exceptions.

4.3 says that anti-replay is optional.  However, Section 1 of 3776 says
that anti-replay is required, though it notes that it can't be done
properly without IKE.  Assuming that IKEv2 is mandated here, anti-replay
should be as well.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

----------
category: Editorial
draft: draft-ietf-mip6-ikev2-ipsec
messages: 271
nosy: admin
priority: Should fix
status: Pending
title: secdir review of draft-ietf-mip6-ikev2-ipsec-07.txt

_________________________________________________
Mip6 issue tracker <[email-masked]>
<http://www.mip4.org/issues/tracker/mip6/issue83>
_________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6