Subject: Re: [MSEC] De-registration protocol?

From: Ran Canetti <[email-masked]>
Date: Thu, 5 Jul 2001 16:10:29 -0400

Thomas, I agree that in some groups it would make sense to maintain a
long-lived secure unicast channel between each group member and the GCKS,
and in other cases it would make sense to keep only short-term unicast
secure channels.

This point should probably make it into the gkmarch document.

btw, this is another very good reason to keep the de-registration 
functionality within the scope of msec - to allow this flexibility 
of design. If we force the application to do de-registration by itself 
then we lose the ability to use a long-lived msec secure unicast channel  
for de-registration...

Ran

> From [email-masked] Tue Jul  3 18:10:20 2001
> 
> 
> David,
> 
> At 7/3/2001||08:54 AM, you wrote:
> 
> 
> >I'd favor noting the possible need for a member-to-controller channel in the
> >architecture, but not spending much short term effort on realizing it.
> 
> 
> Hmm, this brings-up the (old) issue of how long the Cat-1 SA and secure
> channel should be around.
> 
> If we simply want a 1-to-1 secure channel between the member to KDC,
> then we already have this (namely, the Cat-1 SA or
> Registration/Initialization).
> 
> Even if the "secure channel" was SSL or Ran's IPsec-Tunnel, the question
> of the lifetime of the connection remains still.
> 
> And you are absolutely correct is stating that the answer depends
> on the size of the group (which to my mind is application-dependent,
> and to a some extent depends on the availability of a distributed KDC).
> 
> I think it is the application that will decide the type of data, speed,
> capacity or routers/KDCs to hold SAs, etc.
> 
> thomas
> ------
> 
> 

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Mark Baugher <[email-masked]>
Date: Thu, 05 Jul 2001 14:56:45 -0700

>This point should probably make it into the gkmarch document.

I agree.  I'll stop here.

Mark