Subject: [MSEC] Comments on draft-ietf-msec-gkmarch-00.txt

From: Brian Weis <[email-masked]>
Date: Fri, 29 Jun 2001 12:01:01 -0700

Here are a couple of minor comments on this draft which suggest some
rewording.

1. From section 3.2:
> The KDC presents a credential to the Group member that is 
> signed by the Group Owner so the member can check the KDC's 
> authorization. 

This statement is too strong -- a system might do authorization via a
means other than a credential (e.g., ACL). It should say "may present a
credential".

2. From section 3.2:
> The Re-key message is optional because all keys, KEK and TEKs, 
> can be delivered by the Registration Protocol exchanges shown in  
> Figure 1.

Two comments:
a. If there is no Re-key, then a KEK is not necessary.
b. This should also state the obvious, which is the Re-key message is
optional because rekey may be necessary in some scenarios.
I suggest the following re-written sentence: "The Re-key message is
optional because the keys can be delivered by the Registration Protocol
exchanges shown in Figure 1, and those keys may not require updating."

Brian

-- 
Brian Weis
Strategic Cryptographic Development, ITD, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Mark Baugher <[email-masked]>
Date: Fri, 29 Jun 2001 16:25:30 -0700

Thanks, Brian.  See my comments below.

>means other than a credential (e.g., ACL). It should say "may present a

I agree.

>a. If there is no Re-key, then a KEK is not necessary.

We should remove "KEK" from the sentence you cite in 3.2.

>optional because rekey may be necessary in some scenarios.

"optional because rekey may be necessary" does not make sense to me.

>exchanges shown in Figure 1, and those keys may not require updating."

Why not substitute "TEK" for "key" in your re-written sentence?

Mark

---

From: Brian Weis <[email-masked]>
Date: Sat, 30 Jun 2001 11:32:38 -0700

> "optional because rekey may be necessary" does not make sense to me.

Sorry, I should have had a comma between "optional" and "because". My
point was really that rekey is optional, and if there is no rekey there
is no need for a KEK because you won't be sending any more keying data.

> Why not substitute "TEK" for "key" in your re-written sentence?

That would be fine too.

Thanks,
Brian

---

From: Brian Weis <[email-masked]>
Date: Sat, 30 Jun 2001 11:32:38 -0700

That would be fine too.

Thanks,
Brian

---

From: Brian Weis <[email-masked]>
Date: Sat, 30 Jun 2001 11:32:38 -0700

That would be fine too.

Thanks,
Brian

---

From: Brian Weis <[email-masked]>
Date: Sat, 30 Jun 2001 11:32:38 -0700

That would be fine too.

Thanks,
Brian

---

From: Brian Weis <[email-masked]>
Date: Sat, 30 Jun 2001 11:32:38 -0700

That would be fine too.

Thanks,
Brian

---

From: Brian Weis <[email-masked]>
Date: Sat, 30 Jun 2001 11:32:38 -0700

That would be fine too.

Thanks,
Brian

---

From: Brian Weis <[email-masked]>
Date: Sat, 30 Jun 2001 11:32:38 -0700

That would be fine too.

Thanks,
Brian

---

From: Brian Weis <[email-masked]>
Date: Sat, 30 Jun 2001 11:32:38 -0700

That would be fine too.

Thanks,
Brian