Subject: [anonsec] BTNS work in pki4ipsec

From: Black_David at emc.com ([email-masked])
Date: Fri Nov 19 11:02:19 2004

> > >pki4ipsec is not in general limited to VPNs, though -- most of the PKI
> > >interactions are nearly identical for transport mode
> > 
> > But transport mode can include IPIP tunnels too.
> 
> You can pretty much tunnel anything in anything.  So what?
> 
> And yes, unauthenticated IPsec needs to be transport mode only, even
> though sufficiently clever folk could tunnel over that.

I disagree - IP Storage needs tunnel mode for historical reasons,
and I don't want to ask non-security experts to be "sufficiently clever"
about security-related functionality ... unless you want to
encourage "sufficiently clever" security bugs ...

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

---

From: Nicolas.Williams at sun.com (Nicolas Williams)
Date: Fri Nov 19 11:10:20 2004

> encourage "sufficiently clever" security bugs ...

The distinction between tunnel-mode and transport-mode is kinda lame, so
if we can't agree on a restriction of unauthenticated IPsec to transport
mode perhaps we can agree on this restatement of that: 

    Unauthenticated IPsec SHOULD NOT be used to for tunnelling IP
    unless other arrangments are made to authenticate the tunnel prior
    to actual tunnelling.

Nico
--