Subject: Re: [RPSEC] Charter Update

From: [email-masked]
Date: Wed, 18 Jan 2006 15:16:06 -0500 (EST)

Most of the comments so far have dealt with Russ's request for
thoughts on the peering relationships authentication/authorization
mechanisms.

I was also wondering about the following item on the new charter:

July 06 Submit initial document discussing security requirements in an
OSPFv3 mobile ad hoc environment

Is this not also a new item?  I'm not opposed, I'm just wondering
how it got there.

Also, there was discussion in the last rpsec meeting (Aug, Paris)
about Manral's rp-existing-crypto draft.  I'm sorry that I never
spoke up on the list about taking this on - I think we should.
Anyone else want to see the issue of existing crypto mechanisms
(especially existing use of crypto hash algorithms, especially keyed-MD5)
get discussed in the group?

Finally, I think Mar 06 as deadlines for the attack tree and the
OSPF vulnerabilities draft are a bit soon - there's been very little
discussion of these.  And a deadline of Mar 06 for the BGP security
requriements draft would be ..... difficult?  astonishing?

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Wed, 18 Jan 2006 15:32:27 -0500

I concur with Sandy's observations about the OSPFv3 for mobile ad hoc 
nets, and question the appropriateness of this new work item.

Security for routing in ad hoc mobile nets is a hot research topic 
these days. RPSEC is an IETF, not IRTF, group, so it seems a bit 
ambitious to start work on an IETF standard for this tough problem.

Steve

---

From: Russ White <[email-masked]>
Date: Wed, 18 Jan 2006 18:45:48 -0500

> July 06 Submit initial document discussing security requirements in
> an OSPFv3 mobile ad hoc environment
> 
> Is this not also a new item?  I'm not opposed, I'm just wondering how
> it got there.

This is new, and it's from various suggestions I've gotten that we work
on this area. As Steve says in a later email (trying to combine things

> ambitious to start work on an IETF standard for this tough problem.

Working on security implications of the MANET extensions to OSPF being 
proposed is a "middle ground." It's not really "researchy," since some 
of these extension proposals are actually being considered/planned for 
delpoyment, and the extensions are, for the most part, modest extensions 
to OSPF, rather than an entirely new protocol, which limits the scope of 
work.

> spoke up on the list about taking this on - I think we should. Anyone
> else want to see the issue of existing crypto mechanisms (especially
> existing use of crypto hash algorithms, especially keyed-MD5) get
> discussed in the group?

Yes, we could include this in the charter, if we have concensus around it.

> Finally, I think Mar 06 as deadlines for the attack tree and the OSPF
> vulnerabilities draft are a bit soon - there's been very little 

Well, when I wrote this, March 06 seemed like a long time off. Now, it 
seems pretty close. :-) Perhaps we should reset these to be:

- -- Just before the June IETF for stuff that we just need to "wrap up."
- -- Just before the fall IETF for stuff that we feel we need some work 
on, but it's at least written, and in progress, etc.
- -- One year for now for totally new stuff.

:-)

Russ

- -- 
[email-masked] CCIE <>< Grace Alone