[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

I-D ACTION:draft-ietf-ipsec-inline-isakmp-00.txt



 A New Internet-Draft is available from the on-line Internet-Drafts 
 directories. This draft is a work item of the IP Security Protocol Working
 Group of the IETF.                                                        

       Title     : Inline Keying within the ISAKMP Framework.              
       Author(s) : B. Sommerfeld
       Filename  : draft-ietf-ipsec-inline-isakmp-00.txt
       Pages     : 9
       Date      : 11/26/1996

The current proposal for IP-layer key management [ISAKMP, OAKLEY, ISAOAK] 
has fairly high overhead.  Before a security association can be 
established, at least one pair of messages need to be exchanged between the
communicating peers.  For efficiency, this suggests that ISAKMP setup 
should be infrequent.  However, general principles of key management 
suggest that individual keys should be used as little as practical and 
changed as frequently as possible.  Steve Bellovin has suggested that, 
ideally, different security associations should be used for each different 
transport-level connection[BADESP]. 

This document discusses different ways of structuring a protocol to 
permit this to happen with minimal overhead, both in round-trip delay 
at connection setup, and in bandwidth once the connection is established. 

Portions of this protocol have been inspired by SKIP, which is 
fundamentally built around the concept of inline keying[SKIP]. 
SKIP's approach is burdened by the addition of an extra intermediate 
header of perhaps 20 to 28 bytes to every protected packet, essentially 
doubling the overhead of protected traffic compared with ESP 
with manual keying.                                                        

Ideally, an inline keying header would be used only until the desired
security association is established, at which point the peers will
fall back to pure ESP/AH.

Internet-Drafts are available by anonymous FTP.  Login with the username
"anonymous" and a password of your e-mail address.  After logging in,
type "cd internet-drafts" and then
     "get draft-ietf-ipsec-inline-isakmp-00.txt".
A URL for the Internet-Draft is:
ftp://ds.internic.net/internet-drafts/draft-ietf-ipsec-inline-isakmp-00.txt
 
Internet-Drafts directories are located at:	
	                                                
     o  Africa:  ftp.is.co.za                    
	                                                
     o  Europe:  nic.nordu.net            	
                 ftp.nis.garr.it                 
	                                                
     o  Pacific Rim: munnari.oz.au               
	                                                
     o  US East Coast: ds.internic.net           
	                                                
     o  US West Coast: ftp.isi.edu               
	                                                
Internet-Drafts are also available by mail.	
	                                                
Send a message to:  mailserv@ds.internic.net. In the body type: 
     "FILE /internet-drafts/draft-ietf-ipsec-inline-isakmp-00.txt".
							
NOTE: The mail server at ds.internic.net can return the document in
      MIME-encoded form by using the "mpack" utility.  To use this
      feature, insert the command "ENCODING mime" before the "FILE"
      command.  To decode the response(s), you will need "munpack" or
      a MIME-compliant mail reader.  Different MIME-compliant mail readers
      exhibit different behavior, especially when dealing with
      "multipart" MIME messages (i.e., documents which have been split
      up into multiple messages), so check your local documentation on
      how to manipulate these messages.
							
							

Below is the data which will enable a MIME compliant mail reader 
implementation to automatically retrieve the ASCII version
of the Internet-Draft.

No recognizable part in multipart/alternative.