Limitations of IPsec Policy Mechanisms

Abstract

Matt Blaze: I’m not sure if this is deliberate or not, but when you talk about policy stu. you seem to be mixing application policy issues with IPSec policy issues. For example, whether or not X contains the routing for address A is not solved even if you do security of the DPD messages. You need to secure the semantics of DPD, you need a better policy for UPP itself. It’s not clear that that’s a deficiency of IPSec policy per se. That’s a deficiency of trying to use communication security to solve an application semantics security problem, which is more than communication security.

Reply: I think I agree, but we have certain security problems where we don’t really want to go into exactly which layer does what. The whole problem has to be solved whether it’s divided into IPSec paths, communications or something else.