Subject: Re: [MSEC] Re: Session ID and Group ID

From: Hugh Harney <[email-masked]>
Date: Fri, 30 Mar 2001 14:13:40 -0500

Thomas,

In the previous e-mail I tried to discuss how one could specify a key 
download payload without a policy token. In the absence of a policy token 
you must make the key download data rich enough to clearly state where the 
key is to be used.

I've omitted my pitch for a fully specified policy token  :)

Now let's talk about GSAKMP.

Let me try to pull an example of how GSAKMP would supply key to one RAT 
channel and several IPSec channels in a single group.

First, GSAKMP has a policy token that specifies all the mechanisms used in 
the group. So for a single GID the policy token can specify the following 
mechanism.

BEGIN POLICY TOKEN:
Cat 1 mechanisms to define the unicast SA. Let's skip this as it is not 
important in this example.

Cat 2 mechanisms to define group maintenance SA. Let's skip this as it is 
not important in this example.

Cat 3 mechanism to define data channel mechanisms. (We may have the 
following data channel mechanims for a GID. This is an ordered list. I've 
tagged them to illustrate.)

#1 RAT encryption key: 128 bits long.
Rat session #123
Security ProtocolRat interanl
key length128

#2 IPSec encryption key
SPI4847474747474747 …
Security ProtocolESP
Processing DirectionOutgoing
ESP AlgorithmESP-DES
ESP AuthenticationHMAC-SHA
Encapsulation ModeTunnel
SA Lifetypekilobytes
SA Lifetime1000
Source Addr*
Destination Addr224.0.1 (Multicast)
Transport ProtocolUDP
GroupID224.0.1, 12345678
Security LabelReference [7]
Key Creationpreplaced (via GSAKMP)
	
#3 IPSec encryption key
SPI5888888888888
Security ProtocolESP
Processing DirectionOutgoing
ESP AlgorithmESP-DES
ESP AuthenticationHMAC-SHA
Encapsulation ModeTunnel
SA Lifetypekilobytes
SA Lifetime1000
Source Addr*
Destination Addr224.0.1 (Multicast)
Transport ProtocolUDP
GroupID224.0.1, 12345678
Security LabelReference [7]
Key Creationpreplaced (via GSAKMP)
	
This can go on and on.

END POLICY TOKEN

Well in the key download payload we have a type of GTEK. So all we need to 
do is link the keys downloaded under the type GTEK to the mechanisms 
definition above. So the first GTEK would go to the RAT application, the 
second to: #2 IPSec encryption key (SPI = 4847474747474747) and the third 
to: #3 IPSec encryption key	(SPI = 5888888888888).

	

________________________________________________________
Hugh Harney		[email-masked]		410-381-9400 x203
________________________________________________________

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec