Re: Last Call: Security Architecture for the Internet Protocol to Proposed Standard

["Howard C. Berkowitz" <hcb at clark.net>]

At 10:36 -0500 3/31/98, Stephen Kent wrote:
>Howard,
>
>IPsec provides for host-to-host, host-to-gateway, and gateway-to-gateway
>modes of use.  In the host-to-host case, the granularity of an SA can be as
>fine as a port pair, or as coarse as an IP address pair.  So, many of the
>issues you raised are already addressed by the specs.
>
>Steve

Let me try to rephrase.  Yes, I have read the spec and understand these
modes are present.  I am raising concerns about the applicability of these
modes, since some significant user communities have insisted on
host-to-host, a technique that can complicate administration and make it
extremely difficult to use some infrastructure techniques such as NAT.  The
issue of a trusted NAT has been dismissed by some.  I'd simply like to see
more security analysis alternatives in the document or referenced by it.
Otherwise, I have the sense of several working groups each saying "this is
our protocol/mechanism and it's irrelevant how other mechanisms interact
with it."