Re: draft-ietf-ipsp-ipsec-apireq-00 comments

[Bill Sommerfeld <sommerfeld@xxxxxxxxxxxx>]

I've made the following changes, which I hope will clarify my intent.

					- Bill


*** draft-ietf-ipsp-ipsec-apireq-00.xml	2003/06/20 22:52:06	1.4
--- draft-ietf-ipsp-ipsec-apireq-00.xml	2003/06/20 23:59:29	1.5
***************
*** 66,71 ****
--- 66,92 ----
  </t>
  </section>
  
+ <section title='Motivations for this work'>
+ <t>Most protocols for application security, such as <xref
+ target="RFC2246">TLS</xref> and <xref target="I-D.ietf-secsh-architecture">SSH</xref> operate
+ at or above the transport layer.  This renders the underlying
+ transport connections vulnerable to denial of service attacks,
+ including <xref target="I-D.iab-sec-cons">connection
+ assassination</xref>.  
+ IPsec offers the promise of protecting against many of these denial of
+ service attacks.
+ </t>
+ 
+ <t>There are other potential benefits.  Conventional software-based
+ IPsec implementations isolate applications from the cryptographic
+ keys, improving security by making inadvertant or malicious key
+ exposure more difficult.  In addition, specialized hardware may allow
+ encryption keys protected from disclosure within trusted cryptographic
+ units.   Also, custom hardware units may well allow for higher performance.
+ </t>
+ 
+ </section>
+ 
  <section title='Goals'>
  
  <t> Separate policy and mechanism </t>
***************
*** 309,315 ****
  <section title="Exposure of keys">
  <t>
  There is absolutely no reason for applications to see the underlying
! encryption keys.
  </t>
  </section>
  
--- 330,338 ----
  <section title="Exposure of keys">
  <t>
  There is absolutely no reason for applications to see the underlying
! encryption keys, or influence the choice of keys.  This is to allow an
! IPsec implementation to have a clear boundary around its cryptographic
! components.
  </t>
  </section>
  
***************
*** 399,405 ****
  <?rfc include="reference.RFC.2409" ?>
  </references>
  <references title='Informative References'>
! <t>None</t>
  </references>
  </back>
  </rfc>
--- 422,430 ----
  <?rfc include="reference.RFC.2409" ?>
  </references>
  <references title='Informative References'>
! <?rfc include="reference.I-D.iab-sec-cons" ?>
! <?rfc include="reference.I-D.ietf-secsh-architecture" ?>
! <?rfc include="reference.RFC.2246" ?>
  </references>
  </back>
  </rfc>