[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: (IPng) Re: out-of-band key management is like virtual circuits
I, too, believe that the solutions we offer should be capable of
accomodating both in-band and out-of-band KM (or key distribution).
As with other topics, it seems that there are three options (probably
more, but so it goes) for doing this: negotiation that includes IPSP
format; structured SAIDs that connote IPSP format and semantics; and
multiple protocol IDs. Essentially, the second option is a way to
extend the protocol ID space without consuming additional IP next
protocol numbers. I believe Russ's suggestion below has merit; but if
we can't reach agreement on adding such structure to the SAID field,
then I would suggest we consider adopting two protocol IDs, one for
the fixed format structure Bill and Perry have espoused and one with
comparable syntax but with the SAID based extensible option Russ
describes. This argument seems to reduce to the efficiency of where
"protocol" demultiplexing takes place.
I believe it is critical that we leave Danvers with stable documented
proposals (and agreement :-)).
Dave
> Date: Mon, 27 Feb 95 09:17:38 EST
> From: "Housley, Russ" <housley@spyrus.com>
> Subject: (IPng) Re: out-of-band key management is like virtual circuits
>
> Hi Dan.
>
> In IEEE 802.10, when we were developing the Secure Data Exchange (SDE)
> Protocol, this same "in-line" key issue surfaced. It was resolved in a
> manner that has not been considered by the IETF. The solution has pros and
> cons, but I think that it should be considered before a decision is made.
>
> SDE has a 32-bit SAID that is followed by an optional field, called the
> Management Defined Field (MDF). DEC pushed very hard for this field
> because they wanted the SAID to identifiy a Master Key that would be used
> to decrypt the contents of the MDF. The MDF carried the key or keys to
> decrypt and/or check the integrity of the payload.
>
> SKIP is the same idea. SKIP sderives the Master Key using D-H key
> agreement instead of out-of-band master key distribution.
>
> This alternative would permit the approach advocated by DEC, and it would
> accompdate the SKIP approach.
>
> Using a bit in the SAID to indicate the presence/absence of the MDF (or
> whatever we call it for IPSP) would avoid the need for a key management
> protocol to negotiate the attributes for the security association. Perhaps
> a reserved SAID would indicate that the key management technique used by
> SKIP should be used to generate the key to decrypt the MDF.
>
> I just do not see why we cannot architect an IP layer security protocol
> that permits both types of key management.
>
> More food for thought....
>
> Russ
> ------------------------------------------------------------------------------
> IETF IPng Mailing List FTP archive: ftp.parc.xerox.com:/pub/ipng
> Unsubscribe: unsubscribe ipng (as message body, not subject)
> Direct all administrative requests to majordomo@sunroof.eng.sun.com
Follow-Ups: