Subject: Re: [MSEC] CSPRI Implementation of the GSAKMP

From: Sead Muftic <[email-masked]>
Date: Mon, 30 Jun 2003 16:39:30 -0400

Lakshminath:

First, as I mentioned, we based our implementation on the two documents:

> draft-ietf-msec-gsakmp-sec-00.txt (March 2001) and
> draft-ietf-msec-tokenspec-sec-00.txt

I am new to this list and the WG, so I don't know if there are any other
relevant
documents. But, since we are extending our GSAKMP project into another
year, we will
definitely in the next version cover all relevant aspects and standards, if
any of them 
significantly different from the GSAKMP.

As far as those two documents are concerned, we found them very clear and
straight. We could 
implement all GSAKMP messages and Policy Token, so that our GSA system is
operational and 
performs all functions required by the GSAKMP draft. Our interoperability
testing 
with Sparta, Inc. was without serious problems. (Not even close to some
other - PKI interoperability -
projects !) 

However, our main impression is that the specs are over-specified. By that
I mean there are
certain features which are redundant and quite frankly, other than parsing
them from
GSAKMP messages, we do not use them. 

Finally, I personally found GSAKMP draft standard a bit "outside of the
mainstream",
especially wrt PKI, certificates, ASN.1, etc. But, as the first version, it
is quite clear
and not so complicated for the full implementation.

Regards,

Sead Muftic
CSPRI/GWU

-------------------------------

>Hi,
>
>I have a question on the GSAKMP spec.  When I read the spec (-01-, I 
>think), my first feeling was that it is under specified.  I have told 
>Hugh and Andrea this and they said they might be able to include some 
>additional detail, but not a lot.
>
>In your team's experience, is the spec self-contained?  Did you have to 
>refer to other RFCs (which is ok), or did you have to contact the 
>authors or other implementers?  If so, how frequently.
>
>For example, while implementing GDOI, I worked with the ISAKMP and 
>IKE(v1) RFCs, and of course the GDOI I-D.  During the interop testing, I 
>interpreted some attributes differently than Brian did.  After the 
>testing, Brian revamped the spec to remove the ambiguities (is that a 
>fair summary Brian?)
>
>Thanks for your input to the WG.
>
>regards,
>Lakshminath
>
>I might read the GSAKMP spec again when -02- comes out to see whether I 
>would be able to implement it independently.
>

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Lakshminath Dondeti <[email-masked]>
Date: Mon, 30 Jun 2003 17:10:56 -0400

Hi Sead,

Thanks for sharing your opinions on the GSAKMP spec.  Could you 
elaborate on what is *over-specified*?

Also, Hugh noted in his email (dated June 20th) that the spec is ready 
for last call.  In your comments you note "But, as the first version, it
is quite clear and not so complicated for the full implementation."  In 
fact, the current spec dated Feb 2003, is either -01- or -02-, and Hugh 
mentioned that they will be submitting -02-/-03- soon.

Thanks again.

regards,
Lakshminath