Subject: [HOKEY] Key Management Issues

From: Charles Clancy <[email-masked]>
Date: Mon, 17 Mar 2008 20:03:21 -0400

All,

During IETF 71, there was relatively strong room consensus for the 
following changes to the key management document:

- Remove ALL encryption from existing key-mgm document; elimination
   of KDE0, KDE1, and KDE 4
- Lay out security requirements for hop-by-hop security, apply to
   all transports
- Define RADIUS attribute for key request and transport to meet
   HOKEY needs

First, for anyone who did not register an opinion during the meeting, 
here's your chance.

Secondly, we need to figure out how to evolve the document to meet these 
requirements.  I suggest the authors of draft-ietf-hokey-key-mgm-03 and 
draft-gaonkar-radext-erp-attrs-03 work together to merge their two 
documents, and create draft-ietf-hokey-key-mgm-04.  Parts of 
draft-gaonkar-radext-erp-attrs-03 that are specific to ERX should remain 
in place (i.e. text updating RFC 3579) for a v04 of that document.

I've created the following issues to track these changes:

KM: AAA security
http://www.ltsnet.net:8080/hokey/issue40

KM: AAA transport
http://www.ltsnet.net:8080/hokey/issue41

KM: transport security requirements
http://www.ltsnet.net:8080/hokey/issue42

-- 
t. charles clancy, ph.d.                 eng.umd.edu/~tcc
electrical & computer engineering, university of maryland
_______________________________________________
HOKEY mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hokey

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 17 Mar 2008 21:16:10 -0400

Since "ERX fraud issue" raised by Bernard still remains unresolved (at
least I am not convinced at all), I have a reservation on removing
KDE1 and KDE4 from KDE exchange.  KDE1 and KDE4 provide peer consent
for DSRK key distribution, which addresses ERX fraud issue.

Yoshihiro Ohba

---

From: [email-masked]
Date: Tue, 18 Mar 2008 09:56:07 +0800

Subject: Re: [HOKEY] Key Management Issues

> for DSRK key distribution, which addresses ERX fraud issue.

Yes, and it is not compliant with the requirements in RFC4962 if removing 
the KDE1 and KDE4.