Subject: COPS key management question

From: vinay <[email-masked]>
Date: Fri, 12 Jan 2001 07:10:42 -0800 (PST)

Hi
Section 4.2 ( Key Maintenance) in RFC 2748 mentions :
It is good practice to regularly change keys. Keys
MUST be configurable such
that their lifetimes overlap allowing smooth
transitions between keys. At
the midpoint of the lifetime overlap between two keys,
senders should
transition from using the current key to the
next/longer-lived key.
Meanwhile, receivers simply accept any identified key
received within its
configured lifetime and reject those that are not. 
Does this mean that everytime a key is changed, the
open session should be closed
and the security and sequence number negotiation be
done again ( i.e. by
reconnecting and sending an OPN message with the new
key id in the integrity
object after closing the previous session ..) ?
Thanks,
Vinay

__________________________________________________
Do You Yahoo!?
Yahoo! Photos - Share your holiday photos online!
http://photos.yahoo.com/

---

From: "Durham, David" <[email-masked]>
Date: Fri, 12 Jan 2001 10:23:05 -0800

> -----Original Message-----
> From: vinay [mailto:[email-masked]]
> 
> Hi

[Dave] No. All the session keys are identified by their KeyID. Thus, you do
not have to renegotiate anything. The current sequence can be maintained,
because when the key is switched, the KeyID is changed to that of the new
key. 

The above quote deals with how switching keys in an active session is
handled between the client and server (PEP & PDP). It allows their period of
validity to overlap so the transition will work smoothly.