Subject: Re: [MSEC] [Fwd: [Fwd: I-D ACTION:draft-ietf-msec-gkmarch-00.txt]]

From: Ran Canetti <[email-masked]>
Date: Thu, 28 Jun 2001 14:01:25 -0400

Andrea,

Regarding the "offending sentence" in the intro of the new architecture draft:

> Extensions to IKE, however, are probably the best solution for IPsec 
> protocols over IP multicast services [GDOI].

I agree with you that the sentence is poorly phrased and invites 
misinterpretation. It should be rewreitten. Our meaning was to say that
That one of the requirements of the architecture is to enable a GKM protocol 
that allows ESP/AH to work within the MSEC protocol suite without any changes.
This is an important requirement. The reference to GDOI is there since GDOI
took it up as an explcit goal to provide this functionality, so the meaning was to
give it as an example. But GDOI is certainly not the only example. In particular,
I am certain that a resolution of GSAKMP with IPSEC for the registration protocol
would be able to provide the same functionality.
Do you agree with this view of things?

Regarding your note below, I think you're missing some salient points in the new
draft. (And this ofcourse immediately reflects on the authors, who apparently did
a poor job of explaining these points.) In particular, it is NOT compatible with
the current GDOI draft, and GDOI will have to change to fit this document. I'll 
try to provide more details later today or to morrow. So please hold your fire...

Ran

> From: Andrea Colegrove <[email-masked]>
> 
> Mark,
>     The architecture document is for specification and discussion of technical
> issues -- not opinion -- that is the issue at hand.  The document has been written
> as a summary of the BBs with additional constraints and assumptions that are not
> necessary except that GDOI seems to make these assumptions.  This is a fairness
> issue.
>      The "title" of editor sometimes seems more appropriate as the specifications
> that are on standards track should reflect the combined interests of the working
> group -- it is not intended to be honorary or to detract, but merely a reflection
> of the responsibilities of the writers of the documents.
>     I, too, gave technical arguments as to why GDOI may not be the perfect fit.  It
> is not a bad solution, but let us also leave room for the ACME Group Security
> Management Protocol which Joe Schmo has yet to specify.
> 
> --- Andrea
> 
> 

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Andrea Colegrove <[email-masked]>
Date: Thu, 28 Jun 2001 16:42:03 -0400

Hi, Ran,
    Yes I agree that GDOI works well with IPSec and as far as I am aware, GDOI is the
only extension to IKE for groups right now (although you can argue the GSAKMP is an
extension to ISAKMP).

    If it is a requirement that ESP/AH be serviced without modification to IPSec that
would probably be suitable for the requirements section without reference I think to
either GSAKMP or to GDOI -- once again leaving room for the ACME protocol ;-)

    Many of the assumptions in the document are rather GDOI-specific, especially the
policy assumptions.  It will be a difficult process for the WG as a whole to create an
independent document that will not limit new protocols unnecessarily.  Hopefully, we are
now on our way :-)

--- Andrea

---

From: Mark Baugher <[email-masked]>
Date: Thu, 28 Jun 2001 14:05:57 -0700

>only extension to IKE for groups right now (although you can argue the 

An extension to a protocol would at least use the header to that protocol 
and for this
reason, GSAKMP is no extension to ISAKMP.  If we used the same header then
we might be able to find a way to interoperate.

Mark

---

From: Andrea Colegrove <[email-masked]>
Date: Thu, 28 Jun 2001 17:23:19 -0400

Mark,
    Yes.  Which is why I stated it the way I did -- arguably.

    And if we all were willing to take on the complexity, we would all be
extensions to ISAKMP -- IKE, GDOI, and ISAKMP, where ISAKMP is the protocol and the
rest are just switches off of it, as it was originally designed!

--- Andrea

---

From: Andrea Colegrove <[email-masked]>
Date: Thu, 28 Jun 2001 17:32:42 -0400

That is -- IKE, GDOI, and GSAKMP -- sorry.