Subject: [dix] IETF requirement for automated key management

From: Sam Hartman <[email-masked]>
Date: Mon, 5 Jun 2006 18:09:56 -0400 (EDT)

Hi.  I want to draw your attention to RFC 4107.

This rfc specifies a mandatory requirement for new work in the IETF
that except in a small number of cases that there needs to be
automated key management.  For example if you have a protocol like DIX
where there are MACs of messages, you need a key management solution
to set up and maintain these keys.

--Sam

_______________________________________________
dix mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dix

---

From: John Merrells <[email-masked]>
Date: Mon, 5 Jun 2006 15:18:16 -0700

On 5-Jun-06, at 3:09 PM, Sam Hartman wrote:

>  I want to draw your attention to RFC 4107.

Thanks. I'll read that and see if and how it applies to DIX.

John

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 05 Jun 2006 16:43:14 -0700

> to set up and maintain these keys.

As I understand DIX 16.2, the only way in which the MAC is used is for
the Identity Agent to be able to determine that messages it has
generated are valid. The MAC isn't verified by anyone else and 
a MAC is just a suggested implementation anyway. I'm not sure
how automated key management would fit in here.

-Ekr

---

From: John Merrells <[email-masked]>
Date: Mon, 5 Jun 2006 16:55:07 -0700

> how automated key management would fit in here.

Correct, and I don't think it does either.

I'm working on a draft of how an Identity Agent Application (as opposed
to an Identity Agent Website) would work. When using the DIX message
signing and signature verification method this necessitates a  
collaborative
website to receive and process the verify request messages. The 'key'
then needs to be shared between the website and the application. RFC
4107 may play a part in that exchange.

John

---

From: Sam Hartman <[email-masked]>
Date: Mon, 05 Jun 2006 20:29:13 -0400

>>>>> "Eric" == Eric Rescorla <[email-masked]> writes:

    Eric> As I understand DIX 16.2, the only way in which the MAC is
    Eric> used is for the Identity Agent to be able to determine that
    Eric> messages it has generated are valid. The MAC isn't verified
    Eric> by anyone else and a MAC is just a suggested implementation
    Eric> anyway. I'm not sure how automated key management would fit
    Eric> in here.

OK, if so then I am confused.  I thought I saw an instance where the
homesite and the visited site needed to share a MAC key in a previous
version.