Subject: [HOKEY] Key Management domain

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 19 Dec 2007 09:40:38 -0800

Tim, Glen and I met on the Friday of IETF week to craft a definition for
key management domain.  What we came up with is attached below.  I am
working on revising the document with this definition, so please provide
feedback on it. 

Key Management Domain

A key management domain is specified by the scope of a given root key.
The scope is the collection of systems authorized to access key material
derived from that key. Systems within a key management domain may be
authorized to (1) derive key materials, (2) use key materials, or (3)
distribute key materials to other systems.  A derived key's scope is
constrained to a subset of the scope of the key it is derived from.

Thanks,

Joe

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 19 Dec 2007 22:36:11 -0500

- In "(3) distribute key materials to other systems", are "other
systems" in the same key management domain or in any domains?

- Can you provide some example of "collection of systems" in a key
management domain in which a DSRK is the root key?

Yoshihiro Ohba

---

From: Charles Clancy <[email-masked]>
Date: Sat, 22 Dec 2007 18:05:22 -0500

Yoshi,

 > systems" in the same key management domain or in any domains?

Same key management domain.  Devices can't re-scope keys, only narrow 
the scope.

 > management domain in which a DSRK is the root key?

One example could be AAA entities, including servers, clients, and 
proxies.

--
t. charles clancy, ph.d.                 eng.umd.edu/~tcc
electrical & computer engineering, university of maryland

---

From: "Glen Zorn" <[email-masked]>
Date: Sat, 22 Dec 2007 15:58:01 -0800

[gwz] 
Maybe we should add that to the definition for clarification:

"Key Management Domain

A key management domain is specified by the scope of a given root key.
The scope is the collection of systems authorized to access key material
derived from that key. Systems within a key management domain may be
authorized to (1) derive key materials, (2) use key materials, or (3)
distribute key materials to other systems in the same domain.  A derived
key's scope is constrained to a subset of the scope of the key from which it
is derived."

[/gwz] 

...

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 28 Dec 2007 10:07:16 -0500

On Sat, Dec 22, 2007 at 06:05:22PM -0500, Charles Clancy wrote:
> Same key management domain.  Devices can't re-scope keys, only narrow the 
> scope.

OK.

> One example could be AAA entities, including servers, clients, and proxies.

What about an end-system with an EAP peer that generated EMSK for the
key management domain?  The end-system also has access to key material
derived from the root key.

A more general question:

It seems that the definition of key management domain is not only
about the scope of a given root key, but also about part of the
context of the root key, because the definition also talks about key
derivation, use and distribution of child keys.  Is this correct?

On the other hand, the scope and context of a root key depends on each
root key, and it has to be contained in the definition of each root
key.  Said that I am wondering what is the purpose or benefit of
defining key management domain in such a general way.  Why not just
define key management domain specific to DSRK as a root key?

Yoshihiro Ohba

---

From: "Nakhjiri Madjid-VXT746" <[email-masked]>
Date: Sat, 29 Dec 2007 12:43:59 -0500

Why don't we just use "Key scope" as Russ and Bernard defined in their
RFC?

Introducing "domain" as in "key management domain" while we are
frequently talking about domain specific root keys (DSRK) is confusing
and goes in circles.

Madjid 

-----Original Message-----
From: Glen Zorn [mailto:[email-masked]] 
Sent: Saturday, December 22, 2007 3:58 PM
To: 'Charles Clancy'; 'Yoshihiro Ohba'
Cc: [email-masked]
Subject: RE: [HOKEY] Key Management domain

[gwz] 

"Key Management Domain

key's scope is constrained to a subset of the scope of the key from
which it
is derived."

[/gwz] 

...

---

From: Charles Clancy <[email-masked]>
Date: Sat, 29 Dec 2007 13:11:36 -0500

We've created the term DSRK, for which the "D" stands for "domain".  We 
either need to define what a domain is (in terms of key scope), or 
rename the DSRK (among other keys).  The idea of a key management domain 
defines what the "D" is in "DSRK".  I don't think it's circular -- 
whenever we say "domain" we specifically mean "key management domain", 
and the definition of a key management domain is "X".

In the interest of getting this document done, I strongly recommend we 
add the definition proposed to the list to the EMSK keying doc and be 
done with it.

Joe, can you send an updated version of the key management domain 
definition, based on the comments received, to the list?

---

From: "Nakhjiri Madjid-VXT746" <[email-masked]>
Date: Sat, 29 Dec 2007 14:38:56 -0500

This discussion is getting to the point of ad-nauseam.
The "scope" is already defined, the term "domain" is over-stressed,
having AAA domains and administrative domains and authentication domains
(WiMAX), mobility domains (802.11) out there.

I simply fail to understand 
"I don't think it's circular -- whenever we say "domain" we specifically
mean "key management domain", and the definition of a key management
domain is "X"."

If others do, please explain it me.

The interest should be to get _useful_ specs out. You want to change
DSRK to something else, please do it. I am all for it. If domain is the
same key management domain and DSRK, then any key is DSRK, including
USRK which was supposed to be domain independent. 

Madjid

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]] 
Sent: Saturday, December 29, 2007 10:12 AM
To: Nakhjiri Madjid-VXT746
Cc: Glen Zorn; Yoshihiro Ohba; [email-masked]
Subject: Re: [HOKEY] Key Management domain

> The scope is the collection of systems authorized to access key 
> material derived from that key. Systems within a key management domain

> may be authorized to (1) derive key materials, (2) use key materials, 
> or (3) distribute key materials to other systems in the same domain.  
> A derived key's scope is constrained to a subset of the scope of the 
> key from which it is derived."
> 
> [/gwz]
> 
> ...
> 
>

---

From: "Glen Zorn" <[email-masked]>
Date: Sat, 29 Dec 2007 12:25:34 -0800

This discussion is getting to the point of ad-nauseam.
The "scope" is already defined, 
[gwz] 
RFC 4962 never actually defines "scope" or "key scope" -- it just uses the
terms, perhaps assuming that the meaning is obvious.
[/gwz]

the term "domain" is over-stressed,
having AAA domains and administrative domains and authentication domains
(WiMAX), mobility domains (802.11) out there.

[gwz] 
Are you saying you consider the term "domain" in "Domain-Specific Root Key"
to be defined by the environment in which it is used?  
[/gwz]

...

If domain is the
 
[gwz] 
That's a good point: "key management domain" actually _does_ help define the
scope of the key, but it doesn't help much in its derivation: if the name of
the "domain" is included in the key derivation (to make the key
"domain-specific"), what is that name?  If it's not a hostname or DNS domain
name, what?
[/gwz]

Madjid