Subject: Re: [karp] I-D Action:draft-ietf-karp-framework-00.txt

From: mark Brown <[email-masked]>
Date: Sat, 25 Sep 2010 16:25:08 +0530

Hi,

Can we add some verbiage on why the WG thinks extending/reusing IKE
for distributing keys for the routing protocols will not work in this
document?

I see that this version expired a long time back. Any plans of reviving it?

Mark

On Sun, Feb 28, 2010 at 9:15 AM,  <[email-masked]> wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Keying and Authentication for Routing Protocols Working Group of the IETF.
>
>
>        Title           : Framework for Cryptographic Authentication of Routing Protocol Packets on the Wire
>        Author(s)       : W. Atwood, G. Lebovitz
>        Filename        : draft-ietf-karp-framework-00.txt
>        Pages           : 25
>        Date            : 2010-02-27
>
> In the March of 2006 the IAB held a workshop on the topic of
> "Unwanted Internet Traffic".  The report from that workshop is
> documented in RFC 4948 [RFC4948].  Section 8.2 of RFC 4948 calls for
> "[t]ightening the security of the core routing infrastructure."  Four
> main steps were identified for improving the security of the routing
> infrastructure.  One of those steps was "securing the routing
> protocols' packets on the wire."  One mechanism for securing routing
> protocol packets on the wire is the use of per-packet cryptographic
> message authentication, providing both peer authentication and
> message integrity.  Many different routing protocols exist and they
> employ a range of different transport subsystems.  Therefore there
> must necessarily be various methods defined for applying
> cryptographic authentication to these varying protocols.  Many
> routing protocols already have some method for accomplishing
> cryptographic message authentication.  However, in many cases the
> existing methods are dated, vulnerable to attack, and/or employ
> cryptographic algorithms that have been deprecated.  This document is
> one of a series concerned with defining a roadmap of protocol
> specification work for the use of modern cryptogrpahic mechanisms and
> algorithms for message authentication in routing protocols.  In
> particular, it defines the framework for a key management protocol
> that may be used to create and manage session keys for message
> authentication and integrity.  The overall roadmap reflects the input
> of both the security area and routing area in order to form a jointly
> agreed upon and prioritized work list for the effort.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-karp-framework-00.txt
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
>
>
> _______________________________________________
> karp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/karp
>
>

---

From: "Joel M. Halpern" <[email-masked]>
Date: Sat, 25 Sep 2010 10:20:12 -0400

Speaking as co-chair, I would make two observations about this request:

Firstly, the working group has not reach a rough consensus on the 
question of extending / reusing IKE.  The topic has not even been given 
significant discussion.  Hence it would be quite wrong for a working 
group document to claim such an agreement

Secondly, assuming that the working group had the discussion, and reach 
the conclusion, whether the conclusion belonged in this document or not 
woulddepend upon the breadth of the conclusion.  It might be a narrow 
conclusion about specific issues in a specific context, or it might be a 
broad conclusion.  Only after we know what we want to say, if anything, 
would we be able to determine what document it goes in.

Yours,
Joel M. Halpern

PS: Yes, efforts by the authors and others are under way to provide 
revised text for this document (and the other expired documents) which 
address the comments, many of which we have taken unfortunately long to 
properly handle.

On 9/25/2010 6:55 AM, mark Brown wrote:
> On Sun, Feb 28, 2010 at 9:15 AM,<[email-masked]>  wrote: