Subject: Re: [MSEC] Addition to GSAKMP-Lite

From: Hugh Harney <[email-masked]>
Date: Wed, 24 Jul 2002 12:57:21 -0400

Gavin,

I looked into the reference code and our RFC for GSAKMP. I think we need to 
clarify the I-D to ensure rejection notifications are allowed. I'm not sure 
if they have to be mandatory. It was my intention to allow them.

I'd like to hear the lists opinion about making rejection notifications 
mandatory or optional.

We are working on the next revision of the spec. I'll make sure to include 
a discussion about rejection notifications.

I see you point in using rejection notifications to spur a customer to 
action. Well, spur an automatic agent to action.

Hugh

At 03:22 PM 7/24/02 +0100, you wrote:
>Hi,
>
>I am looking at using GSAKMP-Lite to secure multicast
>transmissions over satellite and from going through
>the RFC, there does not seem to be any rejection
>notification sent to the client should it's request to
>join be turned down. I appreciate that in some
>circumstances you don't want to give away any more
>information than you have to, but for my application
>where messages may get lost or corrupted due to the
>transmission medium it would be nice to have a
>mechanism that supplied positive feedback.
>
>Such feedback could also be used to encourage the client to
>pay for a service. i.e. "You are rejected", the client
>would know this is because it hasn't paid a membership
>fee, it could then initiate a payment mechanism and
>reapply to join.
>
>I recognise that GSAKMP supplies such a mechanism via
>the notification payload (e.g. unauthorized request),
>but I couldn't see this in GSAKMP-Lite, which would be
>better for satellite use, due to the reduced number of
>exchanges. I was wondering what the views of the list
>were on this.
>
>regards,
>
>Gavin
>
>This e-mail and any attachment is for authorised use by the intended 
>recipient(s) only.  It may contain proprietary material, confidential 
>information and/or be subject to legal privilege.  It should not be 
>copied, disclosed to, retained or used by, any other party.  If you are 
>not an intended recipient then please promptly delete this e-mail and any 
>attachment and all copies and inform the sender.  Thank you.
>
>_______________________________________________
>msec mailing list
>[email-masked]
>http://www.pairlist.net/mailman/listinfo/msec

________________________________________________________
Hugh Harney		[email-masked]		410-381-9400 x203
________________________________________________________

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Haitham Cruickshank <[email-masked]>
Date: Mon, 29 Jul 2002 16:09:18 +0100

Hi Gavin and Hugh,

I like to continue the discussions that Gavin has raise recently.

> I'd like to hear the lists opinion about making rejection notifications

I agree with Uri that mandatory rejection notifications can lead potentially to
DoS attack against the host containing the Group Controller. Therefore
"optional" rejection notifications
is better and it should be guarded against DoS in the sense of light
computational processing to produce the rejection message.

In addition to Gavin's request,  I like to raise another issue: SCALABILITY
with regards to very large multicast groups.  Both GSAKMP and GSAKMP-Lite
mention the Subordinate Group Controller (SGC) that can provide scalability and
distributed group processing and communication.   However the documents do not
specify the details of how GC and SGC work together.  The RFC 2627 (LKH)
mentions the potential problems with "pushing trust down to each subgroup
controller". Can the authors comment on this please.  If possible, the new
version of the ID may include more details on this please.  Thanks.

Haitham

--
Dr. Haitham S. Cruickshank

Senior Research Fellow in Communications
Centre for Communication Systems Research (CCSR)
School of Electronics, Computing and Mathematics
University of Surrey
Guildford, Surrey GU2 7XH, UK

Tel: +44 1483 686007 (indirect 689844)
Fax: +44 1483 686011
e-mail: [email-masked]
http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/