Re: ISAKMP and SSL

[Charlie_Kaufman@notesdev.ibm.com]

> Hi all,
> Most key management protocols (ISAKMP, TLS Handshake, Oakley, SKEME,
SKIP…)
> even in SSH are based on Diffie-Hellman.
> This can be an additional reason to this issue if we saw that we develop
the
> same key management protocols but every time with a little bit change.
> what i want to say is why every security protocol should propose his own
key
> management schemes if we can unify all this work? I think the first
ISAKMP
> proposition was in this road.

It seems like whenever someone needs a key management protocol, they look
at the ones that already exist (maybe), decide that they are all too
complicated and don't match their needs very well, so they invent a new
one. Then they add features to make it possible for future designers to use
theirs instead of inventing a new one again. In the process, they end up
with a design that is too complicated and doesn't match anyone's needs very
well.

Some people would say that where we've failed is in coming up with a key
management protocol that works for everyone. I disagree. I think that our
failure has been in believing that a single key management protocol can
work for everyone and continue trying to invent it.

The cryptographic guts of these protocols has evolved over time, but not
that much. The real differences come from the different requirements of
different protocols. SSL/TLS runs over TCP, making all kinds of framing and
retransmission issues much simpler. It was developed for browsers and web
servers, where authentication is inherently asymmetric. The browser wants
to authenticate the DNS name of the server, which is fairly tightly tied to
the IP address. But the server doesn't care about the browser's address...
it wants to authenticate the name of the user at the browser; a user who is
likely to move around. Usually today, the server doesn't authenticate the
browser at all. That authentication takes place at a higher layer
(typically with a password in the http header or even a higher layer).

IPsec serves a different audience. Actually several different audiences,
and we're still dealing with their different requirements.

So I believe the "lets design this thing once and for all and have everyone
use it" is a distraction from getting real work done. Yes, look at what's
out there. But don't lose track of the problem you're trying to solve, and
don't spend too much time trying to solve the problems you think someone
else may have someday. They won't thank you for it.

      --Charlie