Subject: [tcpm] draft-bonica-tcp-auth-00

From: Ron Bonica <[email-masked]>
Date: Sat, 17 Sep 2005 10:27:46 -0400

Folks,

Please consider the following draft as an individual submission:

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

-------------------------------------------------------------------
	Title		: Authentication for TCP-based Routing and Management Protocols
	Author(s)	: R. Bonica, A. Heffernan
	Filename	: draft-bonica-tcp-auth-00.txt
	Pages		: 11
	Date		: 2005-9-16
	
   This memo extends RFC 2385 to support time-based key rollover and
   multiple hashing algorithms.  Operators can use the time-based key
   rollover feature to in order to periodically update the key that is
   used to create a message digest for each TCP segment.  Operators may
   also wish to select the hashing algorithm used to create the message
   digest depending upon the perceived threat level and the
   computational capabilities of their hardware platforms.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-bonica-tcp-auth-00.txt

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Ted Faber <[email-masked]>
Date: Mon, 19 Sep 2005 10:39:48 -0700

> A New Internet-Draft is available from the on-line Internet-Drafts
[snip]
> http://www.ietf.org/internet-drafts/draft-bonica-tcp-auth-00.txt

I skimmed this over, and (with my co-chair hat off) the only real
concerns I have with this are:

	* It seems like a bit of a band-aid on the MD5 TCP stuff,
	  without fixing the real problem that it requires configuration
	  coordination.
	* I think that as specified you're free from problems cause dby
	  any but the most ridiculous clock skew, but adding a paragraph
	  indicating that's the case probably wouldn't hurt.
	  Specifically you might want to address when an endpoint can
	  discard authentication entities. You might also want to
	  briefly explain that a host receiving a packet authenticated
	  with an authentication element that the receiving endpoint
	  does not believe has passed its start time is not an error
	  because clocks may have skewed.

Do others have deeper objections?

-- 
Ted Faber
http://www.isi.edu/~faber           PGP: http://www.isi.edu/~faber/pubkeys.asc
Unexpected attachment on this mail? See http://www.isi.edu/~faber/FAQ.html#SIG
_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Ron Bonica <[email-masked]>
Date: Tue, 27 Sep 2005 21:18:58 -0400

Ted,

Thanks for these comments. I have worked them into the next version of
the document and will post it shortly.

                                    Ron