Subject: [MSEC] msec - group security policy

From: Haitham Cruickshank <[email-masked]>
Date: Wed, 30 Oct 2002 13:09:12 +0000

Hi All,

Does anybody know, if there is a standard group policy token that can be
used by secure group key management systems.  This is important for
people who are implementing GDOI or GSAKMP, where details of the policy
functions and structures are required.

Many thanks.
Haitham

--
Dr. Haitham S. Cruickshank

Senior Research Fellow in Communications
Centre for Communication Systems Research (CCSR)
School of Electronics, Computing and Mathematics
University of Surrey
Guildford, Surrey GU2 7XH, UK

Tel: +44 1483 686007 (indirect 689844)
Fax: +44 1483 686011
e-mail: [email-masked]
http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: "Peter Lough" <[email-masked]>
Date: Wed, 30 Oct 2002 09:45:18 -0500

Haitham,

To the best of my knowledge, GDOI does not use a policy token.  Thomas
Hardjono et al published an ID (draft-ietf-msec-gspt-01) last year on a
Group Security Policy Token that described a set of elements that make up a
policy token for a given group and defined a mapping for an IPSec Policy
Token, but no standard exists.

GSAKMP will be releasing the first revision of our policy token in the near
future.  Sunil Iyengar in your department has an advanced copy of it if you
would like to review it.  Our policy token was created as a general
implementation that could provide a general use cryptographic key with
extensible authorizations, access controls and mechanisms.

The current plan is to release it as an appendix to GSAKMP and later move it
to a stand alone specification.

Peter Lough
SPARTA, Inc.

---

From: Haitham Cruickshank <[email-masked]>
Date: Wed, 30 Oct 2002 15:37:29 +0000

Hi Peter,

Peter Lough wrote:

> would like to review it.

I know that, of course.

> Our policy token was created as a general

That is good.  My real question to msec group is to find consensus for a
standard way to define and implement  group security policies.

> to a stand alone specification.

That is great and many thanks.
Haitham

---

From: Mark Baugher <[email-masked]>
Date: Wed, 30 Oct 2002 09:43:27 -0800

hello Haitham and Peter,
    GDOI does not incorporate the policy token.  We would like to get an 
MSEC definition from the policy token.  Speaking for myself, it would be a 
real service to the MSEC WG if some of the people working on the policy 
token would step up to the task of developing the MSEC I-D on this 
topic.  It sounds like Peter said that he was going to do that?

   Peter, did you get my earlier question about ISAKMP, GDOI, and 
GSAKMP?  Should I resend it?

thanks, Mark

---

From: Hugh Harney <[email-masked]>
Date: Wed, 30 Oct 2002 12:53:00 -0500

Mark,

We plan on coming up with a proposed MSEC definition of a policy token. We 
have one 80% completed and are finishing it up.

I'm also putting together a detailed response on your earlier query.

Hugh

At 09:43 AM 10/30/02 -0800, Mark Baugher wrote:
> MSEC definition from the policy token.  Speaking for myself, it would be 
> a real service to the MSEC WG if some of the people working on the policy 

________________________________________________________
Hugh Harney		[email-masked]		410-381-9400 x203
________________________________________________________

---

From: Haitham Cruickshank <[email-masked]>
Date: Wed, 30 Oct 2002 18:15:58 +0000

Hi Mark and Peter

> topic.  It sounds like Peter said that he was going to do that?

Yes I totally agree with Mark that a policy token is an important issue and we
would like it to be defined as soon as possible.  We will be glad to provide input
and feedback.

Haitham