Subject: [MSEC] A few questions on GSAKMP (long)

From: Lakshminath Dondeti <[email-masked]>
Date: Mon, 30 Jun 2003 18:30:34 -0400

Hi Hugh,

I have some questions GSAKMP (draft-ietf-msec-gsakmp-sec-01.txt, Feb 2003).

Sec 4.2.3 on notification messages says:

"The GCKS receives the signed notification and will verify the signature 
on the message to ensure its authenticity and the nonce value.  If the 
message signature or nonce does not verify, the session MUST be 
terminated.  GSAKMP sends a properly authenticated message with a 
Notification Payload of type NACK to indicate termination. "

What happens if this message is lost or has never been sent.  The member 
has no way of knowing whether the message has been delivered or not (at 
least not in the first case :-) ).  In either case, it can go on to 
install the data security SA and listen in on secure group 
communications.  What is the GCKS expected to do?

It sounds counter-intuitive to do nonceC checking after keys have been 
distributed.  Is this to finish in three messages?

What does session termination mean in the context of 4.2.3?   Does the 
GCKS terminate/update the Registration SA, Rekey SA or the Data Security 
SA, or all?  If it is Registration SA, it does not affect the member, 
does it?

In Table 4 of Section 4.3.2, is the Rekey Array same as the Key Download 
payload?  Also, I was wondering if the Rekey message should be HMAC'ed 
to avoid a simple DoS attack.  Why not encrypt the Rekey Array to avoid 
exposing portions of that payload (e.g., length) to eavesdroppers? 
There is also no SEQ number in that message.  How would the members 
distinguish a legitimate Rekey message from a replayed one?  Am I 
misreading the spec here?

In "{}SigX      :Indicates minimum fields used in Signature," I don't 
understand the reference to minimum fields.

Finally, it may be useful to tailor some of the terminology in this 
document along the lines of GKM architecture document.  Furthermore, it 
will be easier for folks planning to analyze the protocol to have all 
the definitions (e.g., NonceC = ..., ACK construction) in the running 
text, not in payload definitions.

May I suggest replacing Key Creation payload with Key Exchange payload?

thanks,
Lakshminath

PS:  The I-D lacks a security considerations section.  You might have 
included one in the latest version.

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec