Subject: [MSEC] MSEC and IGMP

From: "Prashant Pilllai" <[email-masked]>
Date: Mon, 13 Mar 2006 16:53:26 +0000

Hi All

I would be grateful if someone could please clear some of my doubts.

- What is the trigger for GDOI or GSAKMP?

- As far as I can understand the documents, these protocols do not interact
with IGMP at all. So basically a user can still send an IGMP join to connect
to the multicast session, and the router will forward all the multicast
traffic to thi user. But this user will have to first get the keys for this
sesion so will have to use GDOI/GSAKMP to authenticate itself to the GCKS to
get valid keys to actually decode the traffic. Am I correct in saying this?

- So MSEC does not really offer any mechanism to provide network access
control.

- Can GDOI  be used in a distributes architecture? What protocol is used for
multiple GCKS to interact with each other?

Regards
Prashant Pillai
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: Hugh Harney <[email-masked]>
Date: Mon, 13 Mar 2006 12:11:04 -0500

Hi Prashant,

GSAKMP was designed to work in a distributed control architecture. It 
does not provide network access control as you pointed out. It does 
supply key to support various uses, one of which could be network 
access control.

GSAKMP uses notification messages to communicate state information 
within a group. We did not provide any protocol to communicate between 
groups.

Hugh

On Mar 13, 2006, at 11:53 AM, Prashant Pilllai wrote:

> - As far as I can understand the documents, these protocols do not 
> interact with IGMP at all. So basically a user can still send an IGMP 
> join to connect to the multicast session, and the router will forward 
> all the multicast traffic to thi user. But this user will have to 
> first get the keys for this sesion so will have to use GDOI/GSAKMP to 
> authenticate itself to the GCKS to get valid keys to actually decode 
> the traffic. Am I correct in saying this? 
>  
> - So MSEC does not really offer any mechanism to provide network 
> access control.
>  
> - Can GDOI  be used in a distributes architecture? What protocol is 
> used for multiple GCKS to interact with each other?
>  
>  
> Regards
> Prashant Pillai_______________________________________________
> msec mailing list
> [email-masked]
Hugh Harney							Sparta, Inc.
[email-masked]						7075 Samuel Morse Drive
(410) 872-1515 x203					Columbia, MD, 21046

---

From: Brian Weis <[email-masked]>
Date: Mon, 13 Mar 2006 10:08:10 -0800

Hi Prashant,

> - What is the trigger for GDOI or GSAKMP?

The trigger is implementation specific. If could be a static policy 
defined on the group members, or it could be the result of receiving an 
SDP advertisement or some other more dynamic method. (Note that no 
standard method of describing how a device should contact a key server 
has been defined in the MSEC WG.)

> all the multicast traffic to thi user. But this user will have to first 
> get the keys for this sesion so will have to use GDOI/GSAKMP to 
> authenticate itself to the GCKS to get valid keys to actually decode the 
> traffic. Am I correct in saying this? 

That is correct, and it was done intentionally. The MSEC Architecture 
(RFC 3740) describes a method of securing IP multicast data packets 
only. It does not have any dependency on a network admission protocol 
(e.g., IGMP) or multicast routing protocol (e.g., PIM) outside of their 
normal functions.

> - So MSEC does not really offer any mechanism to provide network access 

That is correct. There has been a lot of debate in the IETF over whether 
  the network admission protocol is the right protocol to enforce 
joining a secured group. IGMP is a L3 protocol by which a host asks to 
join a L3 multicast group. Mechanisms to "control" that network 
admission process due to user credentials (which is what people usually 
want to do) using higher level protocols is seen by many as a layer 
violation.

> - Can GDOI  be used in a distributes architecture? What protocol is used 
> for multiple GCKS to interact with each other?

It could be used in a distributed architecture, but no such protocol has 
been defined in the MSEC WG.

Brian

> Regards
> Prashant Pillai
> 
> 
> ------------------------------------------------------------------------
> 

-- 
Brian Weis
Advanced Security Development, Security Technology Group, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: "Prashant Pillai" <[email-masked]>
Date: Wed, 15 Mar 2006 15:33:16 +0000

Hi

Thanx a lot for answering my previous questions.

On reading the different drafts/ and RFC of this WG I am getting really
confused with the following:

What is the need for so many different protocols (GDOI/ GSAKMP/ MIKEY/ GKDP)
for securing multicast traffic?

They all seem to be doing similar things if not the same. For authors and
active members of the group I think it is easy to know, but for people like
me who are new to the group or want to adopt a protocol for implementation
purposes would not actually know what is used for what?

I would be really very grateful if someone could please explain me the
differences between these protocols.

Prashant Pillai

---

From: Hugh Harney <[email-masked]>
Date: Wed, 15 Mar 2006 14:12:16 -0500

GSAKMP provides key and cryptographic policy management services for  
groups, including Many to Many interactions. GSAKMP also provides  
distributed operation to support global and local management of GMs.

On Mar 15, 2006, at 10:33 AM, Prashant Pillai wrote:

> On reading the different drafts/ and RFC of this WG I am getting  
> really confused with the following:
>  
> What is the need for so many different protocols (GDOI/ GSAKMP/ MIKEY/  
> GKDP) for securing multicast traffic?
>  
> They all seem to be doing similar things if not the same. For authors  
> and active members of the group I think it is easy to know, but for  
> people like me who are new to the group or want to adopt a protocol  
> for implementation purposes would not actually know what is used for  
> what?
>  
> On 3/13/06, Brian Weis <[email-masked]> wrote: Hi Prashant,
>>
>> Prashant Pilllai wrote:
>> > Hi All
>> >
>> first
>> access
>> used
Hugh Harney							Sparta, Inc.