CAN/CSA-ISO/IEC 11577-97 (R2015)

1 Scope
2 Normative references
3 Definitions
4 Abbreviations
5 Overview of the Protocol
6 Protocol Functions Common to NLSP-CL and NLSP-CO
7 Protocol Functions FOR NLSP-CL
8 Protocol Functions for NLSP-CO
9 Overview of mechanisms used
10 Connection security control (NLSP-CO only)
11 SDT PDU Based encapsulation Function
12 No-Header Encapsulation Function (NLSP-CO only)
13 Structure and Encoding of PDUS
14 Conformance
Annex A - Mapping UN primitives to CCITT Rec. X.213 -
          ISO 8348
Annex B - Mapping UN primitives to CCITT Rec. X.25 -
          ISO 8208
Annex C - Security Association Protocol Using Key
          Token Exchange and Digital Signatures
Annex D - NLSP PICS Proforma
Annex E - Tutorial on some Basic Concepts of NLSP
Annex F - Example of an Agreed Set of Security Rules
Annex G - Security Association and Attributes
Annex H - Example Key Token Exchange - EKE Algorithm

Scope This ITU-T Recommendation / International Standard specifies a protocol to be used by End Systems and Intermediate Systems in order to provide security services in the Network layer, which is defined by CCITT Rec. X.213 / ISO/IEC 8348, and ISO 8648. The protocol defined in this ITU-T Recommendation / International Standard is called the Network Layer Security Protocol (NLSP). This ITU-T Recommendation / International Standard specifies: (1) Support for the following security services defined in CCITT Rec. X.800 / ISO 7498-2: (a) peer entity authentication; (b) data origin authentication; (c) access control; (d) connection confidentiality; (e) connectionless confidentiality; (f) traffic flow confidentiality; (g) connection integrity without recovery (including Data Unit Integrity, in which individual SDUs on a connection are integrity protected); (h) connectionless integrity. (2) The functional requirements for implementations that claim conformance to this ITU-T Recommendation / International Standard. The procedures of this protocol are defined in terms of: (a) requirements on the cryptographic techniques that can be used in an instance of this protocol; (b) requirements on the information carried in the security association used in an instance of communication. Although the degree of protection afforded by some security mechanisms depends on the use of some specific cryptographic techniques, correct operation of this protocol is not dependent on the choice of any particular encipherment or decipherment algorithm. This is a local matter for the communicating systems. Furthermore, neither the choice nor the implementation of a specific security policy are within the scope of this ITU-T Recommendation / International Standard. The choice of a specific security policy, and hence the degree of protection that will be achieved, is left as a local matter among the systems that are using a single instance of secure communications. This ITU-T Recommendation / International Standard does not require that multiple instances of secure communications involving a single open system must use the same security protocol. Annex D provides the PICS proforma for the Network Layer Security Protocol in compliance with the relevant guidance given in ISO/IEC 9646-2.

Scope This ITU-T Recommendation / International Standard specifies a protocol to be used by End Systems and Intermediate Systems in order to provide security services in the Network layer, which is defined by CCITT Rec. X.213 / ISO/IEC 8348, and ISO 8648. The protocol defined in this ITU-T Recommendation / International Standard is called the Network Layer Security Protocol (NLSP). This ITU-T Recommendation / International Standard specifies: (1) Support for the following security services defined in CCITT Rec. X.800 / ISO 7498-2: (a) peer entity authentication; (b) data origin authentication; (c) access control; (d) connection confidentiality; (e) connectionless confidentiality; (f) traffic flow confidentiality; (g) connection integrity without recovery (including Data Unit Integrity, in which individual SDUs on a connection are integrity protected); (h) connectionless integrity. (2) The functional requirements for implementations that claim conformance to this ITU-T Recommendation / International Standard. The procedures of this protocol are defined in terms of: (a) requirements on the cryptographic techniques that can be used in an instance of this protocol; (b) requirements on the information carried in the security association used in an instance of communication. Although the degree of protection afforded by some security mechanisms depends on the use of some specific cryptographic techniques, correct operation of this protocol is not dependent on the choice of any particular encipherment or decipherment algorithm. This is a local matter for the communicating systems. Furthermore, neither the choice nor the implementation of a specific security policy are within the scope of this ITU-T Recommendation / International Standard. The choice of a specific security policy, and hence the degree of protection that will be achieved, is left as a local matter among the systems that are using a single instance of secure communications. This ITU-T Recommendation / International Standard does not require that multiple instances of secure communications involving a single open system must use the same security protocol. Annex D provides the PICS proforma for the Network Layer Security Protocol in compliance with the relevant guidance given in ISO/IEC 9646-2.