Subject: [Rserpool] Summary of security design team and next conference call - Tuesday, March 4

From: [email-masked]
Date: Thu, 27 Feb 2003 14:21:34 -0600

Hi,

The security design team had a conference call on Tues. Feb. 25. at 10AM EST USA.
Our next call will be Tues. March 4 at 10AM EST USA

Call in details will follow shortly.

Attending on 2/25 were:

Aron Silverton
Maureen Stillman
Michael Tuexen
Qioabing Xie

1) On the subject of the PU (client) authenticating the ENRP server we reached consensus that TLS would be a good mechanism.  We suggest that it be mandatory to implement.  Other authentication mechanisms could be used as well, but they would be optional.  The reason to choose one (namely TLS) for mandatory to implement would be for reasons of interoperability.  Recall that the ADs requested that we add this authentication to prevent a rogue ENRP server from responding to the client.

2) We discussed the Rserpool data and control channels.  Control channel is ASAP messages between the PU and PE and data channel is everything else.

It was generally agreed that the control channel would (optionally) need to be secured.  However, the configuration of the data and control channel is still under discussion.  For example, are the data and control channels required to use the same SCTP association or can they be different.  What happens when you use TCP?  After we sort this out, then we can decide on the security.

Those at the teleconference, please comment on my summary and correct any errors.

Please comment on #1 and #2.  We will discuss this further on our next telecon and at IETF #56.

Please send me e-mail if you wish to participate next Tuesday.  All are welcome.

Thanks.

-- maureen  
_______________________________________________
rserpool mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rserpool