Subject: Re: [MSEC] Re: I-D ACTION:draft-ietf-msec-gkmarch-00.txt

From: Ran Canetti <[email-masked]>
Date: Thu, 28 Jun 2001 15:45:15 -0400

Andrea,  this is indeed an unfortunate typo. Please replace the word "MSEC"
with "The GKM protocol".  Indeed, the GKM protocol does not handle policy 
negotiations and assumes that the policy is already set when the protocol
runs, or alternatively policy is "downloaded" from the KDC to the members 
in an apporpriate policy token. Policy determination will be described, 
I hope, in the upcoming policy architecture draft.

Ran

> 
> 12.
> 
> > MSEC assumes that at least the following group-policy information is
> > externally managed.
> >   o Group owner, authentication method, and delegation method for
> >     identifying a KDC for the group
> >   o Group KDC, authentication method, and any method used for
> >     delegating other KDCs for the group
> >   o Group membership rules or list and authentication method
> >
> 
> These assumptions are unnecessary as was shown by GSAKMP.
>     I.  While the group owner may be published externally, the group owner can also
> be disclosed during the registration protocol.  It can be decided during this time
> whether the owner is acceptable prior to completion of registration.  Once this
> occurs, authenticated group policy can be conveyed to the new member using
> traditional mechanisms such as digital signatures tied to a PKI.
>     II.  The delegation can be stated (authorized) through the authenticated policy
> statement as was done with GSAKMP.
>     III.  Ditto for membership rules and lists
>     IV.  The security association characteristics of the registration protocol can
> be determined early in the registration exchange or in almost all protocols (TLS,
> IPSec, GSAKMP, etc.) can be restricted by what properties the Key Server will
> accept using cipher suite restrictions, SPD constraints, etc.
> 
>     External management of these can be done, but should not be assumed in the
> architecture document.
> 

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec