Subject: [MMUSIC] draft-saito-mmusic-ipsec-negotiation-req-02

From: Makoto Saito <[email-masked]>
Date: Wed, 08 Mar 2006 14:38:50 +0900

Hello everyone,

I submitted a revised individual I-D about IPsec negotiation using SDP.
Although I submitted it a week ago, it's been taking a time before
it appears in the IETF web site.
Until it appears in the archive, you can find it here:

http://www.nttv6.jp/~ma.saito/draft-saito-mmusic-ipsec-negotiation-req-02.txt

Receiving feedback from the previous meeting in Vancouver,
I mainly changed the application scenarios section
in order to make it simple.

Although it's been taking time since the last discussion,
I'd like to discuss this issue in this ML and in the meeting
in Dallas again. And, hopefully the technical specs, too.

Thanks,

-- 
--------------------------------------------------------

Makoto Saito

NTT Communications Corporation

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

---

From: Mark Baugher <[email-masked]>
Date: Wed, 8 Mar 2006 12:35:29 -0800

hi,
   I have read the draft and conclude that if you want to establish  
IPsec connections between devices in the home or anyplace else, it  
should be done through IKE.  I believe that SDP security descriptions  
is a poor solution for this application for a variety of reasons.   
The first of which being that IKE is a more secure solution.

Best Regards, Mark

---

From: Makoto Saito <[email-masked]>
Date: Thu, 09 Mar 2006 21:47:59 +0900

Hi Mark,

Thank you very much for your comments.
I think whether IKE is more secure or not depends on the security
method used for SDP in sdescriptions spec.
That is, while you can use S/MIME based on strong algorithm,
you can also use just sips transport which will reveal the contents
of SDP to the intermediaries.

On the contrary, even IKE is not always a secure solution if you use
the week authentication key such as short PSK.
I think the mechanism of sdes itself is not the problem.

Best regards,

Mark Baugher wrote:
> is a poor solution for this application for a variety of reasons.   The 
> first of which being that IKE is a more secure solution.
> 
> Best Regards, Mark

Makoto Saito