Subject: Re: [MSEC] Generic Policy Token issues

From: Mark Baugher <[email-masked]>
Date: Tue, 02 Sep 2003 10:41:25 -0700

hi Haitham,

At 12:35 PM 8/21/2003 +0100, Haitham Cruickshank wrote:
>Hi All,
>
>I have one comment about Diameter usage for the security policy 
>distribution in relation to GSAKMP protocol: One important property of 
>GSAKMP, that I like, is
>that it is SELF CONTAINED, and does not depend on any other protocols.

I see both an advantage and a disadvantage to this design approach.  The 
advantage is in having a single and complete system - it's specification is 
compact and self contained; this also makes security analysis much 
simpler.  The disadvantage is that one might want to use a different 
announcement protocol, a different authorization mechanism, etc.  This 
diversity is intrinsic to IP networks.

>So, why we should rely on Diameter within a GSAKMP managed group, this
>adds more interworking complications.  May be, Diameter is useful for 
>interworking between GSAKMP and others such as MIKEY and future versions of
>GDOI (GDOI with policy).
>
>My suggestion is that for the generic Policy Token (PT), there should be 
>an option to carry the PT within the protocol itself in order to reduce 
>the dependency on Diameter, if it is not available.

I agree.  I think the best solution would be a generic, or a 
Diameter-specific, definition that can be re-written in TLV, SDP, or 
practically any other syntax.  It should be able to be carried in the key 
management protocol or in some other protocol (with the caveat that careful 
security analysis is needed for a particular implementation - and that's 
practically always the case anyway).

Mark

>Any comments are welcome.
>Haitham
>
>hugh harney wrote:
>>All, Several side exchanges have gone between George and I concerning the 
>>Generic Policy Token. Mostly, we were trying to understand each others 
>>issues and concerns. As is the nature of these exchanges, some technical 
>>suggestions have been made and we wanted to put these suggestions in 
>>front to the MSEC group for consideration.
>>In a side exchange George Gross suggested the following:
>>
>>"1. We borrow the Diameter protocol base specification's Attribute
>>Value-Pair (AVP) syntax and framework for encoding the policy token. See
>>attached e-mail wrt/ to Diameter status, it is in the RFC editors queue.
>>Diameter offers a comprehensive encoding scheme for all types of data, and
>>includes mechanisms for digital signature and encryption based on CMS.
>>
>>2. We do not require implementation of the Diameter base protocol
>>specification, we simply reserve from IANA a set of AVP codes for MSEC
>>usage, the first set of which are allocated for the GSAKMP policy token
>>related AVP.
>>
>>3. For each parameter in the current GSAKMP policy token, we do a one for
>>one mapping of the fields into a corresponding "group AVP" as
>>characterized in section 4.4 of the Diameter specification. We define a
>>syntax for the mandatory and optional AVP for each group AVP." My 
>>questions to the group and to George are:
>>If we (the Generic Policy Token work) focus on the core aspects of the 
>>policy token for version 1 of the Generic Policy Token, how long would it 
>>take to get this written?
>>
>>This is assuming that the Diameter framework is universally acceptable. 
>>Is this true?
>>
>>Hugh
>>
>
>--
>Dr. Haitham S. Cruickshank
>
>Senior Research Fellow in Communications
>Centre for Communication Systems Research (CCSR)
>School of Electronics, Computing and Mathematics
>University of Surrey
>Guildford, Surrey GU2 7XH, UK
>
>Tel: +44 1483 686007 (indirect 689844)
>Fax: +44 1483 686011
>e-mail: [email-masked]
><http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/>http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/ 
>
>

---

From: Haitham Cruickshank <[email-masked]>
Date: Wed, 03 Sep 2003 16:05:44 +0100

Hi Mark,

I completely agree with your both comments about carrying PT and its
encoding, where having various choices and options is good. So that
service providers can pick what suits them best.

Haitham

Mark Baugher wrote:

>> distribution in relation to GSAKMP protocol: One important property
>> of GSAKMP, that I like, is
> I see both an advantage and a disadvantage to this design approach.
> The advantage is in having a single and complete system - it's
> specification is compact and self contained; this also makes security
> analysis much simpler.  The disadvantage is that one might want to use
> a different announcement protocol, a different authorization
> mechanism, etc.  This diversity is intrinsic to IP networks.
>
>
>> adds more interworking complications.  May be, Diameter is useful
>> for interworking between GSAKMP and others such as MIKEY and future
>> versions of
>> GDOI (GDOI with policy).
>>
>> My suggestion is that for the generic Policy Token (PT), there
>> should be an option to carry the PT within the protocol itself in
>> order to reduce the dependency on Diameter, if it is not available.
>
>
> practically any other syntax.  It should be able to be carried in the
> key management protocol or in some other protocol (with the caveat
> that careful security analysis is needed for a particular
> implementation - and that's practically always the case anyway).
>
> Mark
>
>
>
>> > All,Several side exchanges have gone between George and I
>> > concerning the Generic Policy Token. Mostly, we were trying to
>> > understand each others issues and concerns. As is the nature of
>> > these exchanges, some technical suggestions have been made and we
>> > wanted to put these suggestions in front to the MSEC group for
>> > consideration.
>> > If we (the Generic Policy Token work) focus on the core aspects of
>> > the policy token for version 1 of the Generic Policy Token, how
>> > long would it take to get this written?
>> >
>> > This is assuming that the Diameter framework is universally
>> > acceptable. Is this true?
>> >
>> > Hugh
>>
>>
>> --
>> http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/
>>
>

Tel: +44 1483 686007 (indirect 689844)
Fax: +44 1483 686011
e-mail: [email-masked]
http://www.ee.surrey.ac.uk/Personal/H.Cruickshank/

---

From: Andrea Colegrove <[email-masked]>
Date: Wed, 03 Sep 2003 11:40:21 -0400

Please excuse my ignorance, but would it be possible to DER encode 
an AVP specified policy?  It would be nice to tie this to the X.509 
infrastructure support.

--- Andrea

Haitham Cruickshank wrote:

>> analysis much simpler.  The disadvantage is that one might want to 
>> use a different announcement protocol, a different authorization