Subject: [MSEC] IPsec composite groups

From: George Gross <[email-masked]>
Date: Fri, 9 Jun 2006 10:02:56 -0400 (EDT)

Hi,

I would like to bring to your attention an Internet Draft announcement
yesterday for an individual submission that I have written entitled
"Multicast IP Security Composite Cryptographic Groups". The URL for the
draft is:

http://www.ietf.org/internet-drafts/draft-gross-msec-ipsec-composite-group-00.txt

The composite group architectural capability is an outgrowth of the MSEC
IPsec extensions draft that Brian Weis, Dragan Ignjatic, and I have been
working on. In parallel, there has been an IETF-wide initiative to examine
all security protocols, and evaluate their ability to migrate to new
cryptographic algorithms. The composite group capability is a candidate
solution for easing that migration for large-scale cryptographic groups.
Composite groups can also be applied to other use cases wherein a
large-scale group straddles two or more hetrogeneous sub-groups.

Brian and I have debated the merits of including this capability in the
MSEC IPsec extensions draft, and we concluded it is not yet seasoned with
enough operational experience to be placed on proposed standards track.
That said, I believe it represents a potential solution to this type of
problem, and it merits inclusion as an MSEC working group document on the
IETF "experimental track". In the long-term, it may gain sufficient
support to transition from experimental to standards track, similar as
has been seen recently with several RMT working group protocols.

Lakshminath & Ran: As we've discussed off list, I'd like to nominate this
document as an MSEC document.

br,
	George

The Composite Group Internet Draft abstract follows:

The Multicast IP Security extension architecture [Weis] implicitly
assumes a basic group endpoint population that shares homogeneous
cryptographic capabilities and security policies. In practice, large-
scale cryptographic groups may contain a heterogeneous endpoint
population that can not be accommodated by that basic multicast IPsec
architecture. For example, some endpoints may not have been upgraded
to handle the successor algorithm for one that is being retired (e.g.
SHA1 transition to SHA-ng). This document defines the "composite
cryptographic group" IP security architecture capability. A composite
cryptographic group allows multicast IPsec applications to
transparently interact with the single logical group that is formed
by the union of one or more basic cryptographic groups.

_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec