Subject: New SAP draft draft-01.1

From: Mark Handley<[email-masked]>
Date: Tue, 19 Nov 96 20:16:17 -0500

A new draft draft of the Session Announcement Protocol is now available from
  ftp://ftp.isi.edu/confctrl/docs/sap.01.1.ps.gz
(I've also copied the sdp.03.2 draft there too...)

Changes since the previous version are mostly centered around
encryption.  In particular:

- A 32 bit key-id field has been added to greatly reduce the processing power
  used to test new encrypted announcements to see if you can decrypt them.

- The P bit in the SAP header has gone.  It is authentication-mechanism 
  specific and should never have been in the SAP header.

- A new P bit has been carved out of the random field to indicate when the
  actual SDP payload has been padded for encryption.

- The SAP P bit is now replaced by a C (compression) bit to allow SDP
  payloads to be compressed.  I'm not completely convinced by this, but
  when we have authentication headers we get somewhat cramped for space
  in a 1K packet, so it seems like a reasonable idea.

- The multicast-address-test message type has been deleted due to
  overwhelming opposion to it at the Montreal IETF.

In Montreal, some people objected to what they described as
overloading of the authentication header to perform change
verification and also originating user authentication.  They have a
point, but we really don't seem to have space for more than one
authentication header, even with compressed payloads.

Also it was suggested that perhaps we should use an IPSEC
authentication header rather than putting one in SAP.  Unfortunately
this doesn't really work - to do change verification you need to be
able to *assume* that if you put an AH in the packet, receivers can (a)
know it's there, and (b) be able to decrypt it.  With IPSEC and IP4,
this isn't possible.  With IP6 we should be able to, but as IP4
multicast and IP6 multicast don't look like they're ever going to
interwork, we may be able to do things differently with an IP6 SAP.

So, for IP4 SAP I've left the Authentication Header in unchanged.

Most of SAP (with the exception of AH) is implemented in sdr 2.3a1 now
released.  Of course sdr 2.3a1 is broken on little-endian machines,
but that's another story :-)

Mark