Subject: [Tsvwg] draft-ietf-ipsec-sctp-03.txt

From: [email-masked]
Date: Fri, 15 Mar 2002 19:36:41 +0200

Hi all!

	This draft assumes that all the source-destination paths should be encrypted/authenticated... But I was wondering, why not being able to encrypt just the packets that follow some path?

	As far as I know, the use of IPsec is not really cheap in terms of calculation time. So, maybe not all the messages within an SCTP association have to be encrypted. I don't really know how easy is to enable/disable IPsec functionality, but I guess it will not be that easy (since it affects to all the TCP/SCTP connections/associations using that IP address...)

	So, I was thinking, why not being able to encrypt just some of the paths? Then, as we (upper user) are supposed to be able to state which destination address we want to use, we could have a way to enable/disable encryption this way...

	I know that the Primary Address is the one that is supposed to be used always, and we shouldn't mess with the election of the destination address, but I have the impression that this use might be interesting...

	Any comment?

	Thanks!

	BR Iván Arias Rodríguez

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: "Armando L. Caro Jr." <[email-masked]>
Date: Fri, 15 Mar 2002 17:30:19 -0500 (EST)

Hi Ivan,

comments below...

On Fri, 15 Mar 2002 [email-masked] wrote:

> 	This draft assumes that all the source-destination paths should
> be encrypted/authenticated... But I was wondering, why not being able
> to encrypt just the packets that follow some path?

Yeah, we have discussed this idea on occassion too.  The idea is a secure
and unsecure channel using a single association. I really haven't spent
any time thinking about the details, but it seems like something that may
be useful.

BTW, congrats on your thesis. Seems to be fairly thorough. I have read
some of it so far... It's been a fun read.

~armando

0--                                                --0
| Armando L. Caro Jr.     |       [email-masked] |
| University of Delaware  |  www.cis.udel.edu/~acaro |
0--                                                --0

---

From: Michael Tuexen <[email-masked]>
Date: Sun, 17 Mar 2002 22:22:48 +0100

Are you thinking about different trust levels for different
networks (this means different security levels per path) or
for different portions of the communications (this could
mean different security levels per SCTP stream).

If you interested to secure only a portion of the traffic TLS
might be want you are looking for...

Best regards
Michael

> | University of Delaware  |  www.cis.udel.edu/~acaro |
[email-masked]

---

From: "Armando L. Caro Jr." <[email-masked]>
Date: Mon, 18 Mar 2002 02:25:36 -0500 (EST)

> mean different security levels per SCTP stream).

Well, in the email I was just thinking different trust levels for
different networks, but I am actually curious about both possibilities.

> might be want you are looking for...

Good to know.

~armando

0--                                                --0

---

From: Qiaobing Xie <[email-masked]>
Date: Thu, 28 Mar 2002 15:38:57 -0600

>         So, I was thinking, why not being able to encrypt just some of the paths? Then, as we (upper user) are supposed to be able to state which destination address we want to use, we could have a…

The downside with this approach would be that there won't be a
guaranteed way to send a specific message encrypted. This is because a
retransmission might cause the message to be sent to a dest addr other
than the one elected by the app and this alternate addr may not be
secured.

-Qiaobing