[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: a missing piece
From: Steve Bellovin <smb@research.att.com>
To: ipsec@ans.net
Sender: smb@research.att.com
>The IPv6 security protocols are supposed to work host to host or
>gateway to gateway. But we haven't specified a protocol for hosts
>to use to specify to their security gateways (by which do not necessarily
>mean firewalls) what security services are desired. Similarly, we
I think that if an end node is trusted to request security when it is
needed, then it could almost always provide the security. The vast
majority of gateway to gateway cases will be imposed by administrative
policy rather than trusted an end node to request services, although
there should certainly be provivison for that.
There is also the case of end and gateway talking to each other...
>need a protocol -- an IPv6 header, to be more precise -- by which
>the security gateway can (over a nominally-trusted wire) what security
>services were in effect for received packets. The former is rather
>reminiscent of the IP security label option, though I won't call it
>such for fear of reopening a can of worms; the latter has some tricky
>aspects, such as stripping out bogus incoming security service headers
>and dealing with IP within IP.
I agree here.
> --Steve Bellovin
Donald
References: