Subject: [eap] Fix references to group key management protocol in EAP Key management framework I-D

From: Lakshminath Dondeti <[email-masked]>
Date: Mon, 03 Apr 2006 00:22:36 -0700

Description of issue: EAP Key management framework I-D currently says 
in Page 14

"
IKEv2, defined in [RFC4306], handles the derivation of unicast
      security associations (phase 2a), while the derivation of multicast
      security associations (phase 2b) is handled in a separate group key
      management protocol, as described in [RFC4046]. "

The problem is 4046 describes MSEC's group key management framework 
and not a particular key management protocol.  MSEC has specified 
three key management protocols for group key establishment and they 
are GDOI, GSAKMP and MIKEY and is working on a third GKDP (this one 
is *similar* to IKEv2).

I'd also suggest using the phrase "establishment of multicast SAs" 
instead of "derivation ..."

Submitter name: Lakshminath Dondeti
Submitter email address: [email-masked]
Date first submitted: April 3, 2006
Reference: <>
Document: Document Requiring change [Keying Framework]
Comment type: ['E']
Priority: ['S' Must fix]
Section: 2.1
Rationale/Explanation of issue:  See above.
Length description of problem

Requested change:

"while the establishment of multicast security associations (phase 
2b) may be handled by a group key management protocol such as GDOI 
[RFC3547], GSAKMP [RFC-to-be-GSAKMP], MIKEY [RFC3830], or GKDP 
[GKDP-work-in-progress]."

+++++++++

regards,
Lakshminath 

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: Jari Arkko <[email-masked]>
Date: Thu, 06 Apr 2006 20:52:16 +0300

I agree with your complaint about the current text. But
I have a question for you: do any of the protocols
that you list in the proposed text work with EAP-based
authentication? If yes, then those can be listed. Otherwise
it might be more appropriate to say "... while the establishment
of multicast security associations (phase 2b) is not
supported for EAP-based authentication", or words
to that effect.

--Jari

Lakshminath Dondeti wrote:

> are GDOI, GSAKMP and MIKEY and is working on a third GKDP (this one is
> *similar* to IKEv2).
>
> "while the establishment of multicast security associations (phase 2b)
> may be handled by a group key management protocol such as GDOI

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 06 Apr 2006 11:19:56 -0700

hmm, I may be misunderstanding but let me ask you this.  Phase 2b is 
for group SA establishment, right.  The SA establishment protocol 
(e.g., the 4-way or the 2-way exchanges in 11i for GTKSA 
establishment) doesn't have to support EAP.

I can answer your question on whether MSEC GSA establishment 
protocols do or intend to support EAP, but I wonder whether it's 
relevant in this context.  As I noted, I may have a misunderstanding 
of Phase 2b, and if so please feel free to correct me.

thanks Jari,
Lakshminath

---

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 06 Apr 2006 13:30:21 -0700

How about this?

"IKEv2, defined in [RFC4306], includes support for EAP and handles the 
establishment of unicast security associations (phase 2a).  However, the 
establishment of multicast security associations (phase 2b) typically does 
not involve EAP and needs to be handled by a group key management protocol 
such as GDOI [RFC3547], GSAKMP [GSAKMP], MIKEY [RFC3830], or GKDP [GKDP]."

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 06 Apr 2006 19:00:14 -0700

Sounds good.  Thanks Bernard.

regards,
Lakshminath

At 01:30 PM 4/6/2006, Bernard Aboba wrote:
>How about this?
>
>"IKEv2, defined in [RFC4306], includes support for EAP and handles 
>the establishment of unicast security associations (phase 
>2a).  However, the establishment of multicast security associations 
>(phase 2b) typically does not involve EAP and needs to be handled by 
>a group key management protocol such as GDOI [RFC3547], GSAKMP 
>[GSAKMP], MIKEY [RFC3830], or GKDP [GKDP]."
>
>

---

From: Jari Arkko <[email-masked]>
Date: Fri, 07 Apr 2006 07:22:55 +0300

Works for me.

Bernard Aboba wrote:

> establishment of unicast security associations (phase 2a).  However,
> the establishment of multicast security associations (phase 2b)
> typically does not involve EAP and needs to be handled by a group key
> management protocol such as GDOI [RFC3547], GSAKMP [GSAKMP], MIKEY
> [RFC3830], or GKDP [GKDP]."
>
>
>
>