Subject: [karp] Only two lifetimes?

From: Sam Hartman <[email-masked]>
Date: Tue, 08 May 2012 16:36:31 -0400

So,  at the last KARP meeting we talked about whether to simplify
management models or wether to implement everything that could be used
by a protocol.

Between version 01 and 02 of the key tables draft, the NotBefore and
NotAfter fields were expanded to {Send|Receive}Not{Before|After}. 

Yes, some routing protocols have this flexibility.

however it doesn't seem necessary.
Why is a key that is inappropriate for verifying packets in the key
table at all? Why not go back to the 01 model and have only two times?
We can also provide a way to mark a key disabled by setting its
direction to disabled rather than in/out/both.

I believe this will provide the flexibility people actually use while
simplifying configuration somewhat.

--Sam

---

From: Russ Housley <[email-masked]>
Date: Tue, 8 May 2012 16:52:56 -0400

We got a request for this structure because (as you point out) some routing protocols have this flexibility.  The person making the request wanted to support this flexibility.

Russ

---

From: Sam Hartman <[email-masked]>
Date: Tue, 08 May 2012 17:41:45 -0400

>>>>> "Russ" == Russ Housley <[email-masked]> writes:

    Russ> We got a request for this structure because (as you point out)
    Russ> some routing protocols have this flexibility.  The person
    Russ> making the request wanted to support this flexibility.  Russ

Right.  I'm asking the WG to push back on that request and/or for the
person making the request to come forward with a more complete
justification than existing protocols support this.

---

From: Uma Chunduri <[email-masked]>
Date: Fri, 18 May 2012 19:56:51 -0400

For TCP based RPs these two lifetimes are any ways not negotiable through KMP. 
A locally configured Master key life-time is good enough to roll over the same using KMP
and roll over time need not be synchronized explicitly with the peer. So, one re-key 
configuration value specified in "secs" is sufficient. 
I am just wondering how these 2 operator entered lifetimes work with KMP? 

-- 
Uma C. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sam Hartman
Sent: Tuesday, May 08, 2012 1:37 PM
To: [email-masked]
Subject: [karp] Only two lifetimes?

So,  at the last KARP meeting we talked about whether to simplify management models or wether to implement everything that could be used by a protocol.

Between version 01 and 02 of the key tables draft, the NotBefore and NotAfter fields were expanded to {Send|Receive}Not{Before|After}. 

however it doesn't seem necessary.
Why is a key that is inappropriate for verifying packets in the key table at all? Why not go back to the 01 model and have only two times?
We can also provide a way to mark a key disabled by setting its direction to disabled rather than in/out/both.

I believe this will provide the flexibility people actually use while simplifying configuration somewhat.

--Sam
_______________________________________________
karp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/karp