Subject: Re: [MSEC] GSAKMP issue 03: recipient ID

From: Uri Meth <[email-masked]>
Date: Sun, 7 Sep 2003 12:22:39 -0400

Reposting, as my first attempts did not appear to make it to the list.

Based on this lack of definition of the term "recipient ID",
we propose the following wording for this paragraph in
section 4.2.1. (NOTE: I am putting the whole paragraph here, including
the lead in sentances that were not in the original post.)

Standard design principles for secure protocols mandate the use of
explicit identification of senders and recipients of messages.
The signature payload of each message identifies the signer of
the message and therefore satisfies the sender requirement.  Within
the GSAKMP header is a group ID. Because the member may be served by any
Key Server within a group, this group ID provides sufficient granularity
to identify the intended recipient of the Request To Join message.
Other messages sent by the potential member will contain the
identification of the GCKS serving that member contained within the
Identification payload.

UM

On Fri, Aug 08, 2003 at 03:25:49PM -0400, George Gross wrote:
> 
> GSAKMP issue 03
> 
> Section and relevant text passage:
> 
> section 4.2.1: "Within the GSAKMP header is a group ID. Because
> the member may be served by any Key Server within a group, this ID provides
> sufficient granularity for the recipient ID for the Request to Join message.
> Other messages sent by the potential member will contain the recipient ID
> for the GCKS serving that member."
> 
> Comment/issue description:
> 
> The term "recipient ID" is not previously defined, and it is not explicitly 
> mentioned anywhere else
> in the document. In what namespace is the "recipient ID" allocated?
> 
> Suggested issue resolution:
> 
> Add an example of a "recipient ID", e.g. is it an IP-v4 address in the
> globally routable Internet? an X.509 D.N? point to a table defining the
> possible namespaces.
> 
> 
> _______________________________________________
> msec mailing list
> [email-masked]
> http://www.pairlist.net/mailman/listinfo/msec

-- 
Uri Meth                            (410) 872 - 1515 x233 (voice)
SPARTA, Inc.                        (410) 872 - 8079      (fax)
7075 Samuel Morse Drive             [email-masked]
Columbia, MD 21046

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: George Gross <[email-masked]>
Date: Tue, 9 Sep 2003 15:57:37 -0400 (EDT)

Hi Uri,

> identification of the GCKS serving that member contained within the

thank you, the above text is clearer, but does still have some ambiguity.
A follow up question: is the Group ID a multicast IP address? or an
anycast IP address? In other words, when a group member sends the RTJ,
does the IP header's destination IP address match the Group ID's IP
address or the IP address of a particular GCKS?  The spec should
explicitly call this out (particularly relevant for IP-v6).

thx,
	George