Re: [Isms] pre11 comments

[Wes Hardaker <wjhns1 at hardakers.net>]

>>>>> On Thu, 3 Jul 2008 20:57:08 -0400, "David B. Nelson" <d.b.nelson at comcast.net> said:

DBN> Apparently the WG decided early on that, indeed, "any protected
DBN> transport will do".  I think what you're effectively suggesting is
DBN> that we should *not* have a general TSM, but a series of xSMs,
DBN> where "x" is a specific secure transport protocol.

That was one of the suggestions that I said was possible if we wanted to
solve the issue.  I also said it was the one that I think was already
decided against.  The other one was a security name mapping.  If you go
back to my original post, I mentioned a few options and one of which was
a mapping table in the 

DBN> KSM surely falls into that pattern.

No, actually, it doesn't because it already was designed (in IETF
history of the past) to be a separate security model and wasn't based on
a tunnel transport and thus wasn't TSM based.  So with KSM we already
had the ability to separate out KSM from USM.  I'm simply looking for
a similar ability from future transport support.

DBN> Personally, I think it's very late for that kind of revision.  However, if
DBN> it can be "hacked in" without much disruption, I see no fundamental
DBN> objection to adding that feature.

There wouldn't be little disruption (a minor wording change here or
there and a MIB table).  I'd be happy to supply the text and table for
inclusion but I will wait until people think it's ok to consider
including before committing resources to it.
-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms