Subject: "connection latching" -- comments on rfc2401bis (draft-ietf-ipsec-rfc2401bis-04.txt)]

From: Nicolas Williams <[email-masked]>
Date: Wed, 15 Dec 2004 06:04:28 -0600

"Connection latching" is a simple concept: connections, for connection-
oriented protocols, such as TCP or SCTP, that are run over IPsec should
be 'bound' to the same quality of protection parameters and initiator
and responder IDs for their duration.

IOW, the SPD should be modified dynamically as a TCP (or SCTP)
connection is attempted/connected/torn down so that during its lifetime
the connection's IP packets are protected only with comparable SAs.

The more I think about it, the more I think that "connection latching"
a) seems very much related to the "populate from packet" feature of
2401bis, b) should be an integral part of the IPsec architecture, c) is
absolutely necessary in situations where applications drive policy
(e.g., through IPsec APIs), particularly where GSS-API and other channel
binding to IPsec is to be used.

BTW, and for full disclosure, there exist implementations of this
concept, in Solaris 9 and 10, for example.

Nico
-- 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Joe Touch <[email-masked]>
Date: Wed, 15 Dec 2004 09:56:09 -0800

Nicolas Williams wrote:
| "Connection latching" is a simple concept: connections, for connection-
| oriented protocols, such as TCP or SCTP, that are run over IPsec should
| be 'bound' to the same quality of protection parameters and initiator
| and responder IDs for their duration.
|
| IOW, the SPD should be modified dynamically as a TCP (or SCTP)
| connection is attempted/connected/torn down so that during its lifetime
| the connection's IP packets are protected only with comparable SAs.
|
| The more I think about it, the more I think that "connection latching"
| a) seems very much related to the "populate from packet" feature of
| 2401bis, b) should be an integral part of the IPsec architecture, c) is
| absolutely necessary in situations where applications drive policy
| (e.g., through IPsec APIs), particularly where GSS-API and other channel
| binding to IPsec is to be used.
|
| BTW, and for full disclosure, there exist implementations of this
| concept, in Solaris 9 and 10, for example.
|
| Nico

There's nothing in IPsec that knows about TCP connections now, and there
shouldn't be.

There might be utility to coordinating TCP with IKE, but that means that
the SA used by a packet needs to be set explicitly by the upper layer
rather inferring it from policy rules.

I.e., TCP may need to know about IPsec, not the other way around.

Joe

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 15 Dec 2004 11:57:32 -0600

> I.e., TCP may need to know about IPsec, not the other way around.

Connection latching should, indeed, be initiated by TCP -- but that does
not mean the matter shouldn't be mentioned in the IPsec architecture
doc.