RFC 5387: Problem and Applicability Statement for Better-Than-Nothing Security (BTNS)
In plain English — editorial summary, not part of the RFC
The Internet network security protocol suite, IPsec, requires authentication, usually of network-layer entities, to enable access control and provide security services. This authentication can be based on mechanisms such as pre-shared symmetric keys, certificates with associated asymmetric keys, or the use of Kerberos (via Kerberized Internet Negotiation of Keys (KINK)). The need to deploy authentication information and its associated identities can be a significant obstacle to the use of IPsec. This document explains the rationale for extending the Internet network security protocol suite to enable use of IPsec security services without authentication. These extensions are intended to protect communication, providing "better-than-nothing security" (BTNS). The extensions may be used on their own (this use is called Stand-Alone BTNS, or SAB) or may be used to provide network-layer security that can be authenticated by higher layers in the protocol stack (this use is called Channel-Bound BTNS, or CBB). The document also explains situations for which use of SAB and/or CBB extensions are applicable. This memo provides information for the Internet community.
Document record
- Document ID
- RFC5387
- Published
- November 2008
- Authors
- J. Touch; D. Black; Y. Wang
- Status
- INFORMATIONAL
- Stream
- IETF
- Area
- sec
- Pages
- 28
- Also known as
- —
Topics
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 4301Security Architecture for the Internet ProtocolUpdated
December 2005
- RFC 2401Security Architecture for the Internet ProtocolObsoleted
November 1998
- RFC 5374Multicast Extensions to the Security Architecture for the Internet ProtocolCurrent
November 2008
- RFC 5660IPsec Channels: Connection LatchingCurrent
October 2009
- RFC 5755An Internet Attribute Certificate Profile for AuthorizationCurrent
January 2010
- RFC 4945The Internet IP Security PKI Profile of IKEv1/ISAKMP, IKEv2, and PKIXCurrent
August 2007
- RFC 5879Heuristics for Detecting ESP-NULL PacketsCurrent
May 2010
- RFC 5996Internet Key Exchange Protocol Version 2 (IKEv2)Obsoleted
September 2010
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?