Subject: Re: [MSEC] GSAKMP issue 17: clarify authorization roles

From: Uri Meth <[email-masked]>
Date: Fri, 3 Oct 2003 13:30:57 -0400

Upon further reflection and investigation, the information of Signature
ID Role is superfluous.  I really don't care what the SigPL tells me his
role is, this must be checked against the Policy Token.  Therefore, this
information should really be deleted from this PL.  This way, there is
no need to save (irrelevant) state information, we always check
everything against the source, the Policy Token.

UM

On Fri, Aug 08, 2003 at 03:40:48PM -0400, George Gross wrote:
> 
> GSAKMP issue 17
> 
> Section and relevant text passage:
> 
> 6.8 Signature Payload table 16 authorization types
> 
> Comment/issue description:
> 
> The authorization roles appear to be something that the GM must save as GSA
> state information. Then when a rekey message arrives, if the rekey originated
> from a party who is not a key server then the message should be ignored. right?
> 
> Suggested issue resolution:
> 
> the text should explain how the group member interprets this field, and uses
> its for authorization screening. It should suggest error logging by the GM.
> 
> 
> _______________________________________________
> msec mailing list
> [email-masked]
> http://www.pairlist.net/mailman/listinfo/msec

-- 
Uri Meth                            (410) 872 - 1515 x233 (voice)
SPARTA, Inc.                        (410) 872 - 8079      (fax)
7075 Samuel Morse Drive             [email-masked]
Columbia, MD 21046

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: George Gross <[email-masked]>
Date: Sun, 5 Oct 2003 17:39:01 -0400 (EDT)

Hi Uri,

> everything against the source, the Policy Token.

this makes sense. so long as there is some text explaining the
authorization check on the re-key message's source, verifying that it is a
GCKS, and describing the GM's error response when it isn't a GCKS, then
this issue is closed.

thx,
	George