Subject: Re: [MSEC] CSPRI Implementation of the GSAKMP

From: Sead Muftic <[email-masked]>
Date: Tue, 01 Jul 2003 10:32:05 -0400

Lakshminath:

>Thanks for sharing your opinions on the GSAKMP spec.  Could you 
>elaborate on what is *over-specified*?

By "over-specified" I really mean specs of the Policy Token, especially wrt
PKI and certificates.
Without elaborating all the details, just take "Owner PKI" payload. It
contains "PKI Type"
(strange formulation !?) meaning "the type of the certificate ... ".
However, just by giving
Issuer's DN and serialNumber (standard elements of every certificate) you
may get from the certifiate
its type. The same with "Public Key Length" - you really don't need that,
since by extracting
public key from the certificate, you can get its length. Many other aspects
can be quoted. It 
seems that Policy Token was structured to be "self-contained", which I call
"over-specified" as
many aspects of PKI and certificates could have been solved by using
appropriate references to
standard PKI and certificate attributes.

However, taking both specs (GSAKMP and Policy Token) as given, then
implementation is straight forward
and not complicated. Furthermore, interoperability goes quite smoothly.

Regards,

Sead Muftic
CSPRI/GWU

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Brian Weis <[email-masked]>
Date: Tue, 01 Jul 2003 14:56:06 -0700

Lakshminath Dondeti wrote:
> 
> Hi,
> 
> I have a question on the GSAKMP spec.  When I read the spec (-01-, I
> think), my first feeling was that it is under specified.  I have told
> Hugh and Andrea this and they said they might be able to include some
> additional detail, but not a lot.

I've just glanced at the -03 version that Thomas just mentioned, and it
seems to me that there are more details then there used to be.

> In your team's experience, is the spec self-contained?  Did you have to
> refer to other RFCs (which is ok), or did you have to contact the
> authors or other implementers?  If so, how frequently.
> 
> For example, while implementing GDOI, I worked with the ISAKMP and
> IKE(v1) RFCs, and of course the GDOI I-D.  During the interop testing, I
> interpreted some attributes differently than Brian did.  After the
> testing, Brian revamped the spec to remove the ambiguities (is that a
> fair summary Brian?)

Yes, that is a fair summary. In fact, there were just a few subtle
ambiguities that were realized, but finding them was invaluable. 

I'm wondering if this was also true with the GSAKMP implementations?

Brian

> Thanks for your input to the WG.
> 
> regards,
> Lakshminath
> 
> I might read the GSAKMP spec again when -02- comes out to see whether I
> would be able to implement it independently.
> 
> Sead Muftic wrote:
> >
> >
> > I would like to inform this group that Cyber Security Research and
> > Policy Institute
> >
> > of The George Washington University has recently completed the full
> > implementation
> >
> > of the GSAKMP protocol, together with the first secure group
> > application: secure
> >
> > instant messages within a group. The implementation is based on the
> > documents
> >
> >
> > draft-ietf-msec-gsakmp-sec-00.txt (March 2001) and
> >
> > draft-ietf-msec-tokenspec-sec-00.txt
> >
> >
> > The implementation has been successfully tested against another
> > implementation
> >
> > by Sparta, Inc, processing Policy Token file and all GSAKMP messages.
> >
> >
> > Soon, all the information about our on-going "Survivable Group Security
> > Architecture"
> >
> > project including our software for download will be available on the
> > Institute's Web
> >
> > site. In the meantime, for any additional information please contact me
> > directly.
> >
> >
> > Regards,
> >
> >
> > Sead Muftic
> >
> > Research Director
> >
> > CSPRI/GWU
> >
> >
> > _______________________________________________ msec mailing list
> > [email-masked] http://www.pairlist.net/mailman/listinfo/msec
> >
> 

-- 
Brian Weis
Strategic Cryptographic Development, ITD, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]

---

From: Sead Muftic <[email-masked]>
Date: Wed, 02 Jul 2003 10:50:11 -0400

>I'm wondering if this was also true with the GSAKMP implementations?

As I announced, our implementation is based on the first version of the
GSAKMP.
The reason we didn't follow upgrades is very simple: we were waiting for the
protocol to become stable (standard), then we will upgrade our
implementation in 
the second year of the project (Sept 2003 - Sept 2004).

In addition, we have also designed and implemented a comprehensive security
architecture 
for the GSA system, so (for shortage of manpower), we couldn't concentrate
strictly on the GSAKMP.
But, the upgrade to the (soon to be) official standard is definitely one of
our future tasks.

Regards,

Sead Muftic
CSPRI/GWU