Subject: [MSEC] [Fwd: [Fwd: GSAKMP - rekeying - synchronisation]]

From: Haitham Cruickshank <[email-masked]>
Date: Thu, 20 Mar 2003 12:25:50 +0000

Hi All,

Was there a problem with the msec mailing list in the last few days ?.

Haitham

-------- Original Message --------
Subject: [Fwd: GSAKMP - rekeying - synchronisation]
Date: Tue, 18 Mar 2003 18:21:40 +0000
From: Haitham Cruickshank <[email-masked]>
Organization: CCSR
To: msec group <[email-masked]>

-------- Original Message --------
Subject: GSAKMP - rekeying - synchronisation
Date: Tue, 18 Mar 2003 12:45:09 +0000
From: Haitham Cruickshank <[email-masked]>
Organization: CCSR
To: Hugh Harney <[email-masked]>, Peter Lough <[email-masked]>
CC: msec group <[email-masked]>

Hi Hugh and Peter,

We have a small question regarding the synchronisation between a secure
multicast group members after a rekeying event.  This is a general
concept for GSAKMP and GDOI, however I will ask the question in context
of GSAKMP.

The question is: After the GSAKMP server sends a server-rekey message to
all GSAKMP clients to update their traffic keys (such as member leaving
or joining, etc..), how the traffic sender (multicast source) and the
multicast traffic receivers will synchronise the use of the new keys
that has been just distributed by the GSAKMP server ?.

In the context of using GSAKMP with IPSEC, one idea is to use the
traffic key-handle (which is distributed by the GSAKMP server with the
key itself) as the SPI (Security Parameter Index) in IPSEC.    If this
is correct, then a server re-key message received by the GSAKMP client
means a new IPSEC key and new SPI as well (new security association).
In this case, re-synchronisation is not a problem as more.

Any comments on this are welcome.

Haitham & the Surrey team.
--
Dr. Haitham S. Cruickshank

Senior Research Fellow in Communications
Centre for Communication Systems Research (CCSR)
School of Electronics, Computing and Mathematics
University of Surrey
Guildford, Surrey GU2 7XH, UK

Tel: +44 1483 686007 (indirect 689844)
Fax: +44 1483 686011
e-mail: [email-masked]
http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec