Subject: [MSEC] GSAKMP issue 04: Process RTJ needs additional definition

From: George Gross <[email-masked]>
Date: Fri, 8 Aug 2003 15:26:48 -0400 (EDT)

GSAKMP issue 04

Section and relevant text passage:

section 4.2.1.1 Request to Join

" If the results of <Process RTJ> indicate that the GCKS should
reject the request, the session MUST be terminated..."

Comment/issue description:

The semantics of the <Process RTJ> section are underspecified:

a. The text does not say that the GCKS should send a Notify to the GM
nor does it enumerate which Notify error status could be sent.

b. This section should recommend how many times the GM should resend a Request To Join
and at what time out interval, before giving up after hearing no response.

c. The text should explain the algorithm by which the freshness of the NONCE_I is verified.

d. This section and the section that follows (4.2.1.2) make forward references to the abbreviation
NONCE_I, NONCE_R, and NONCE_C, which is not defined until section 6.11. This is confusing.

e. The text should explain GCKS versus GM version number mismatch semantics here. It should
be possible for a v1 GSAKMP GM to interoperate and participate with a GCKS v2.

Suggested issue resolution:

Each of the above sub-issues should be explained in the revised text. A complete list of the
error response should be given in a table. The policy token spec should also be rev'd to
allow declaring a _list_ of permitted GM version numbers.

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec