Subject: [MMUSIC] Comments on draft-saito-*ipsec

From: Eric Rescorla <[email-masked]>
Date: Wed, 05 Jul 2006 08:48:05 -0700

I've reviewed both these drafts. Comments below.

The general idea behind these drafts appears to be that IKE
negotiation for IPsec is too complicated and should rather
be replaced with an SDP-based mechanism, at least for
SIP-based applications.

I'm skeptical that this is a good idea for several reasons:

1. It's true that IKE is very complicated, but there's no in 
   principle reason why an SDP-based solution should be superior
   to IKE, since the parameters for the SPD still need to be
   established no matter how it's done. In particular, I don't
   see why the policy descriptions being offered in 
   draft-saito-mmusic-sdes-ipsec-00 are any easier for
   users or administrators to deal with than the policies
   for IKE.

2. The specific mechanism described in draft-saito-mmusic-sdes-ipsec-00
   uses inline keys and therefore relies on end-to-end confidentiality
   using S/MIME, which is, to say the least, not widely deployed.

I don't think this is really an appropriate line of work for
this WG.

-Ekr

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

---

From: Makoto Saito <[email-masked]>
Date: Thu, 06 Jul 2006 15:56:18 +0900

Hello Eric,

Thank you for your review and comments.

As you pointed, one of the motivations is to avoid
complication of IKE, but I also emphasize on the delay
of key-exchange in case of IKE. I wanted to avoid a time lag
between media and SDP negotiation.

Anyway, if policy control over SDP is still complicated,
it will lose many of the advantages...
>From that viewpoint, my main point is using just a simple
set of parameters (probably host-to-host ESP based on
AES-128)automatically, although protocol itself
allows fine-grained policy. But it may be controversial.

And, your second point is more essential to me.
I think the advantage of sdes mechanism is its independency
of the security mechanism of SDP.
In other words, the framework itself can be used for various
situations.
So, if only using S/MIME, it wouldn't be widely accepted,
but I also think to use this framework with other security mechanisms
such as PSK-based full-meshed peer network, sips with trusted SIP
proxies network, and so on. This kind of applicability is
essential to service providers.

Thanks,

-- 
Makoto Saito