Subject: [anonsec] Tunnel mode

From: Black_David at emc.com ([email-masked])
Date: Fri Nov 19 13:11:19 2004

> > > And yes, unauthenticated IPsec needs to be transport mode only, even
> > > though sufficiently clever folk could tunnel over that.
> > 
> > I disagree - IP Storage needs tunnel mode for historical reasons,
> > and I don't want to ask non-security experts to be "sufficiently clever"
> > about security-related functionality ... unless you want to
> > encourage "sufficiently clever" security bugs ...
> 
> The distinction between tunnel-mode and transport-mode is kinda lame, so
> if we can't agree on a restriction of unauthenticated IPsec to transport
> mode perhaps we can agree on this restatement of that: 
> 
>     Unauthenticated IPsec SHOULD NOT be used to for tunnelling IP
>     unless other arrangements are made to authenticate the tunnel prior
>     to actual tunnelling.

I think that's ok - "other arrangements" would include a higher
level authentication that included a channel binding.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------