Subject: [MSEC] Re: MSEC draft - Composite Cryptographic Groups

From: [email-masked]
Date: Tue, 11 Jul 2006 11:11:53 -0400 (EDT)

Hi Haithem,

> Hi George,
> Here are some late comments about your draft
> (draft-gross-msec-ipsec-composite-group-00):
>
> I feel the issue of Composite Cryptographic Groups real and has to be
> addressed for large groups.  For example in IP satellite networks, the
> groups can very large and distributed over multiple administrative domains
> with various security and general policy requirements.

yes, security domain (or nation specific) specific policy is another
motivation for composite groups. In the context of satellite, a spot beam
antenna aimed at each sub-group could minimize the bandwidth consumed.

>
> I feel the current draft lack some details about the Composite Group
> Distributor (CGD).  For example, the location of the CGD:  It can be
> within the group speaker domain, or other subgroup domains.  May be one or
> two diagrams can clarify that.

I will see what I can do in the way of adding some "typewriter/ASCII art" ;o)

internal details of CGD are implementation dependent, I am not sure that
would be advisible. OTOH, if the externally visible behavior needs more
detail, I would welcome a suggestion from you about what you need
clarified....

>
> Another general multicast issue is that the group speaker sends to a
> certain IP multicast address and the receivers subscribe to a different IP
> multicast address (at least in IPsec transport mode), where the CGD make
> the change of destination address. I wonder if there are any other
> operational implications of such design.

Other than the nuisance of making debugging abit more complex, it is hard
to say. getting operational experience with composite groups is one of the
reasons that I'm suggesting that it be placed on experimental RFC track.

thx for the review!

br,
   George

P.S. note that MSEC is on a new mail list alias
>
> Haitham
>
>
>
>
> ----
> Dr. Haitham S. Cruickshank
> Lecturer
> Communications Centre for Communication Systems Research (CCSR)
> School of Electronics, Computing and Mathematics
> University of Surrey, Guildford, Surrey GU2 7XH, UK
>
> Tel: +44 1483 686007 (indirect 689844)
> Fax: +44 1483 686011
> e-mail: [email-masked]
> http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/
>

_______________________________________________
MSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/msec

---

From: [email-masked]
Date: Tue, 11 Jul 2006 11:11:53 -0400 (EDT)

Hi Haithem,

thx for the review!

br,
   George