Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-21 Thread Danny Mayer
On 10/20/2011 1:39 AM, Cui Yang wrote: > As I have noted in the last email, timestamping all packets is too costly to afford to. We have done some experiments on our products, the degrading of performance is unacceptable. That is why we need to distinguish 1588 packet from others with high priority

Re: [IPsec] ´ð¸´: [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-21 Thread Danny Mayer
On 10/19/2011 10:09 PM, Cui Yang wrote: [...] > 1. Most doubts have been cast on the rationale of encryption. Thanks to comments by Tim and others, this requirement comes from 3GPP spec., as explained in the Introduction, where it says that 3GPP spec. SHALL support encryption/tunnel in backhaul lin

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-20 Thread Danny Mayer
On 10/19/2011 7:50 AM, Bhatia, Manav (Manav) wrote: > Hi, > > I had spoken to one of the initial authors of this IPsec draft and I was told that setting up an Ipsec tunnel exclusively for shipping 1588 may not be possible in the femto architecture. They are thus trying to use WESP (that I have co-

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-20 Thread Danny Mayer
On 10/18/2011 3:33 PM, Nico Williams wrote: > On Tue, Oct 18, 2011 at 12:45 PM, Kevin Gross wrote: >> Nico's contention is that it should take a constant amount of time to >> decrypt a packet once it is received. I don't think this is exactly true but >> when compared to other (variable) latencies

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-19 Thread Danny Mayer
On 10/18/2011 2:16 PM, paul_kon...@dell.com wrote: > Absolutely. But if you allow, say, one second round trip time, you have > to assume that your time is off by that amount from the master. No, half that amount. Round trip means exactly that! In an > environment without active attackers you w

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-19 Thread Danny Mayer
On 10/18/2011 12:42 PM, Kevin Gross wrote: > It does seem reasonable to consider modeling encryption and decryption > in as part of network latency. As long as delays introduced are the same > each direction, the sync protocols will naturally subtract out this > contribution. I very much doubt tha

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-19 Thread Danny Mayer
On 10/18/2011 11:37 AM, Tim Frost wrote: > I think most of the reviewers are missing the point of this draft. > > The point is not that the timing packets are inherently secret and need encryption, but that the 3GPP architecture mandates that EVERYTHING flowing to the femtocell must be inside a se

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-16 Thread Danny Mayer
On 10/15/2011 9:29 PM, Nico Williams wrote: > On Fri, Oct 14, 2011 at 7:19 PM, David L. Mills wrote: >> Nico and Danny, >> >> It might help to explain the issues in the NTP white papers at the NTP >> project page www.eecis.udel.edu./ntp.html. Chapter 16 in the book shows the >> results of experime

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-16 Thread Danny Mayer
--Original Message- > From: tictoc-boun...@ietf.org [mailto:tictoc-boun...@ietf.org] On Behalf Of > Danny Mayer > Sent: Thursday, October 13, 2011 5:08 PM > To: Kevin Gross > Cc: ipsec@ietf.org; tic...@ietf.org; Cui Yang; David L. Mills > Subject: Re: [TICTOC] Review request f

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-14 Thread Danny Mayer
and decrypted when sent making for additional uncertainties and errors. I have not reviewed how the two-step IEEE 1588 protocol works so I don't have a good understanding of the effects of IPsec encryption on such packets. Danny > Kevin Gross > > On Thu, Oct 13, 2011 at 8:43 AM, Danny

Re: [IPsec] [TICTOC] Review request for IPsec security for packet based synchronization (Yang Cui)

2011-10-13 Thread Danny Mayer
On 9/18/2011 9:41 PM, Cui Yang wrote: > Dear IPsec experts, > cc TICTOC WG > > May I make a review request for the draft on > "IPsec security for packet based synchronization" > > http://datatracker.ietf.org/doc/draft-xu-tictoc-ipsec-security-for-synchronization/ > > Abstract: > Cellular network