Subject: Re: [lisp] Virtual meeting

From: "Alberto Rodriguez Natal (natal)" <[email-masked]>
Date: Wed, 1 Apr 2020 21:17:45 +0000

Joel, Dino,

I like it. This is actually something that Fabio and I discussed some time ago as a possible option but we never really closed on it.

@Fabio: What do you think?

Alberto

From: lisp <[email-masked]> on behalf of Dino Farinacci <[email-masked]>
Date: Tuesday, March 31, 2020 at 5:38 PM
To: Joel Halpern Direct <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [lisp] Virtual meeting

Yes, you did. Great. Let’s get some opinions from the list and from the LISP-SEC experts. Fabio would have to comment on how flexible the Map-Reply Authentication Data field is to add the pubsub key-material.

Map-Request:

Map-Reply:

Dino

On Mar 31, 2020, at 5:31 PM, Joel Halpern Direct <[email-masked]<mailto:[email-masked]>> wrote:

Yep, that fills in the details nicely.  I started from "we should be able to bootstrap the security through lisp-sec".

Yours,
Joel

On 3/31/2020 8:27 PM, Dino Farinacci wrote:

Sorry, yes, it is the MS, not the MR, who provides the information to construct the key, since it is the MS who is generating the notifies. Sorry I still cross them up.
Oh good. That is more clear now. So if you are saying this:
(1) Use LISP-sec as defined today.
(2) Have the MS wrap some new key material with the MS-OTK and pass it to the ETR.
(3) The ETR replies as it does today but we have new protected key material in the Map-Reply.
(4) The MS stores the new key-material.
(5) The ITR generates the new key-material because it can unwrap the MS-OTK that is derived from the ITR-OTK.
(6) Any subsequent unsolicited Map-Notify messages from the MS (for an RLOC-change) are signed with the new key-material. Which the ITR can verify since it has the new key-material from step (5).
That is a shared-key created with the pair of OTKs. I think that can work. Fabio needs to verify.
I know you didn’t say all these details but I’m progressing your point, for discussion.
Dino

---

From: Dino Farinacci <[email-masked]>
Date: Wed, 1 Apr 2020 14:39:20 -0700

> I like it. This is actually something that Fabio and I discussed some time ago as a possible option but we never really closed on it.

So both the Map-Request AD and Map-Reply AD need changes to include the wrapped pubsub key (I referred to this key in the last email as the “new key-material”).

So a summary:

(1) The MS generates random number, that is the pubsub key, encrypts it with the ITR-OTK. Either proxy replies to the ITR or forwards Map-Request to the ETR with the wrapped pubsub key in the AD field. In the latter case, the ETR forwards that wrapped key to the ITR. 

(2) The ITR decrypts the wrapped key with the ITR-OTK.

(3) Any Map-Notify messages are signed with the pubsub key and verified by the ITR with the same shared pubsub key.

Both the ITR and MS (where the subscription state is stored) holds the pubsub key. Rekeying can reoccur whenever the above is done again and the map-server decides to allocate an new random number.

Agree? Comments?

Dino

---

From: "Prakash Jain (prakjain)" <[email-masked]>
Date: Wed, 8 Apr 2020 03:09:27 +0000

Hi Joel,
Sorry, missed this earlier. I have earlier asked a slot in Vancouver to present lisp-site-external-connectivity draft (https://tools.ietf.org/html/draft-jain-lisp-site-external-connectivity-00).

If slots are still available in virtual session, we would like to have 10 min slot to discuss this.

Thanks,
Prakash

On 3/10/20, 2:44 PM, "lisp on behalf of Joel M. Halpern" <[email-masked] on behalf of [email-masked]> wrote:

    Vancouver has been cancelled.
    We have several ways we can hold a virtual interim.  (The chairs have a 
    webex available, and Fabio has offered one.)
    
    I understand that folks want to present their work.
    But what I am looking for if we are going to get folks together is 
    actual engagement on the list.  Indication that there are things worth 
    discussing.
    
    Yours,
    Joel
    
    _______________________________________________
    lisp mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/lisp

---

From: "Joel M. Halpern" <[email-masked]>
Date: Tue, 7 Apr 2020 23:11:41 -0400

Luigi, I believe we can plan a slot for this?
Yours,
Joel