Subject: RE: [MSEC] De-registration protocol?

From: Ran Canetti <[email-masked]>
Date: Thu, 5 Jul 2001 16:25:05 -0400

David, Thomas, Mark, all,

I agree that implementing the de-registration can/should be postponed
until we have things working. But I do think that we should keep it in mind
as a potential functionality of the msec protocol suite. 

let me try to summarize the points against leaving it to the application:

- It will force the application to set up its own secure channels between 
each member and the GCKS. This would be done in addition to the msec secure 
channels, will require its own negotiations, policy, etc. Why burden the
application with all that? 

- It will force us to set up a way for the msec module in the GCKS to receive
leave operations from the application module. This will complicate the
interface of the msec module inside the GCKS. 

- It will disallow joining the de-registration operation with other msec
operations (such as sending the de-registration message over a long-lived
msec secure channel).

Best,

Ran

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Mark Baugher <[email-masked]>
Date: Thu, 05 Jul 2001 15:14:47 -0700

Ran

>application with all that?

I think it's unavoidable.  It's not that bad since SSL, SET, or other protocols
may be better suited to the purpose and, in the case of SSL, it is widely
available.  This is true for trust (e.g. certificate management) and other
services that may be need for some key management applications.

>interface of the msec module inside the GCKS.

What's the "msec module?"  In GDOI, there is an authorization interface
(as there is in IKE and other key management systems).   For GDOI,
this interface is where key management gets told to send a Re-key
message.  There is zero overhead here.

>operations (such as sending the de-registration message over a long-lived

There is no de-registration message and there should not be one in my
opinion.  I think this is the crux of cfm's posting, if I read it right.

thanks, Mark