Re: Re: Re: [ssm] SSM with IPSec

[Mark Baugher <mbaugher@cisco.com>]

I started from Toerless' position and wanted to focus only on SSM for using 
the source address for looking up a security association.  But how does an 
IPsec implementation identify that an incoming packet is SSM?  I thought we 
could rely on a 232/8 address and its corollary in IPv6.  But that's not 
the case since some 232/8 addresses could be ASM and some SSM channels 
could use addresses outside the 232/8 range.  This means that something 
needs to signal to IPsec that an SA is an SSM SA, and that's probably going 
to be key management.  by implication, key mgt thus also signals when an SA 
is ASM (i.e. NOT SSM).

Many applications, moreover, don't want just SSM because it has one SA per 
sender.  Nice for replay protection but bad when there are many 
senders.  So we (Thomas, Brian, Ran and me) are working up a proposal that 
encompasses both.  One complication is that in some cases an IPsec host 
does a 4-tuple (source addr, dest addr, protocol, spi) lookup and sometimes 
3 (source address is a wildcard).  Another complication is in having a 
replay window for ASM when there are multiple senders that are not known 
when the SA is established; thus, replay windows need to be brought up on 
the fly.

Mark

At 12:43 PM 1/15/2003 -0500, Hugh Holbrook wrote:
>I'm not sure.
>
>I think it will be somewhat easier but I suspect not "much easier" to
>do an SSM-only solution.  But I don't know and I'm waiting to see the
>msec proposal.  I do think it would be prudent to take your points
>under consideration when looking at the msec proposal, though.
>
>-Hugh
>
> > Date: Wed, 15 Jan 2003 09:11:37 -0800
> > From: Toerless Eckert <eckert@cisco.com>
> > Cc: Brad Huntting <huntting@glarp.com>, ssm@ietf.org,
> >       mbaugher@cisco.com, bew@cisco.com
> >
> > On Wed, Jan 15, 2003 at 11:48:22AM -0500, Hugh Holbrook wrote:
> > >
> > > I agree with you, and I didn't mean to imply that this was an SSM-only
> > > problem.  NTP is a good example of an ASM app that has the same
> > > problem.  The fact that this problem occurs with ASM is a complicating
> > > factor in determining the right solution (which is a major reason that
> > > I don't want to tackle it in SSM).
> >
> > I don't yet understand the details of the key management yet, but
> > correct me if i'm wrong: Wouldn't a solution with channel-only
> > support (eg: SSM only) be able to be much easier than one that
> > needs to support a multi-source group concept ? Given that simplicity
> > is one key argument for SSM, it would be good if the security solution
> > in support of SSM was not necessarily encumbered by additional
> > complexity only required for ASM. Eg: probably have two approaches,
> > one that will only work with SSM and one which will work for ASM
> > but of course also SSM.
> >
> > Wrong line of thought ?

_______________________________________________
ssm mailing list
ssm@ietf.org
https://www1.ietf.org/mailman/listinfo/ssm