Re: Modefg considered harmful

[Bora Akyol <bora@cisco.com>]

At 04:55 PM 2/3/2003 -0500, Stephen Kent wrote:
>In 2401bis, we plan on de-coupling route selection from SA selection, by 
>having an explicit lookup for routing performed prior to SA selection, and 
>then passing along a virtual interface ID as part of the SA selection 
>process.  This is something that was discussed among a set of folks 
>interested in PPVPN and overlay nets over the last several months. If 
>adopted, this would make it easier to accommodate the sort of full-fledged 
>routing participation that you allude to.


I fear that this is straying from the scope of the ipsec working group to 
something much larger. As you point out there is no infra-structure in the 
Internet to verify that either a route or its advertiser are authentic. 
Specification of a virtual interface ID is implementation specific.

I want to understand more of the concern here. Is the concern that ipsec 
SAs are being used to route traffic or due to the uncontrolled routing, 
some packets that should be secured are going in the clear due to the wrong 
interface selection?

Can you please elaborate the reasoning behind this concern and verbiage?

Thanks

Bora