Subject: [karp] Call for WG adoption: draft-mahesh-karp-rkmp-04

From: "Joel M. Halpern" <[email-masked]>
Date: Mon, 29 Jul 2013 03:18:22 -0400

This draft has been discussed in the WG, and revised based on WG 
feedback and discussions among the authors.
At this point, the question is whether it is ready for the WG to 
formally take the draft on and take it forward.

So this is a call for adoption of
http://datatracker.ietf.org/doc/draft-mahesh-karp-rkmp/
by the KARP WG.
Please respond to the list with support or substantive objections within 
3 weeks (adding a week since we are in the IETF meeting.

Yours,
Joel M. Halpern

---

From: Russ Housley <[email-masked]>
Date: Mon, 29 Jul 2013 03:47:25 -0400

I am confused by the approach taken in this draft.  I only skimmed it.  We defined a crypto key table, and that document is close to IESG approval.  I think that IKEv2 should be used to populate the key table, and then TCP-AO can pull keying material from the table, as is already described, at least partially, in the key table document.

Russ

On Jul 29, 2013, at 3:18 AM, Joel M. Halpern wrote:

> This draft has been discussed in the WG, and revised based on WG feedback and discussions among the authors.
> At this point, the question is whether it is ready for the WG to formally take the draft on and take it forward.
> 
> Please respond to the list with support or substantive objections within 3 weeks (adding a week since we are in the IETF meeting.
> 
> Yours,
> Joel M. Halpern

---

From: Sam Hartman <[email-masked]>
Date: Mon, 29 Jul 2013 04:23:09 -0400

>>>>> "Russ" == Russ Housley <[email-masked]> writes:

    Russ> I am confused by the approach taken in this draft.  I only
    Russ> skimmed it.  We defined a crypto key table, and that document
    Russ> is close to IESG approval.  I think that IKEv2 should be used
    Russ> to populate the key table, and then TCP-AO can pull keying
    Russ> material from the table, as is already described, at least
    Russ> partially, in the key table document.  Russ

RKMP is intended to work with the key table draft as you describe.
With the specific case of TCP-AO there are some additional complexities
because of abstractions created by the TCP-AO spec.
It's certainly intended to be the case that rows are added to the key
table by RKMP and it's intended to be the case that TCP-AO interacts
with the key table in a manner similar to how it handles manual keying
with regard to RKMP.

If we got some details wrong, I think we can fix that after WG adoption.

---

From: Joe Touch <[email-masked]>
Date: Mon, 29 Jul 2013 09:02:52 -0700

> because of abstractions created by the TCP-AO spec.

The complexities are at least partly related to the fact that IKE is based on network (IP) protocols and sequences of streams using the same ports, whereas TCP-AO never reuses connection keys on successive connections to the same ports.

The complexities are non-trivial, and require the introduction of a new mechanism to translate between the expectations of IKE and TCP-AO. draft-mahesh-karp-rkmp describes this mechanism in detail.

> with the key table in a manner similar to how it handles manual keying

draft-ietf-karp-crypto-key-table describes some very limited ways in which RKMP might interact with TCP-AO, but those limitations are severe - using one key across all interfaces, e.g. At best, crypt-key-table is dismissive in its support for TCP-AO; at worst, it gives recommendations that could be ill-advised.

This document (draft-mahesh-karp-rkmp) provides a specific mechanism to more completely interface TCP-AO to IKE, where that mechanism compensates for the different assumptions of TCP-AO and IKE regarding connection and key usage. 

(note that mahesh-karp does refer to crypto-key-table, but it adds significantly to it)

Joe

---

From: Joe Touch <[email-masked]>
Date: Mon, 29 Jul 2013 10:31:55 -0700

FWIW, I obviously support this as a WG doc (though, as a co-author, I'm 
clearly biased). I gave substantive reasons in a previous post earlier 
today.

Joe

On 7/29/2013 12:18 AM, Joel M. Halpern wrote:
> _______________________________________________
> karp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/karp

---

From: Uma Chunduri <[email-masked]>
Date: Mon, 29 Jul 2013 17:42:34 +0000

Support (also co-author). 

-- 
Uma C. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Joel M. Halpern
Sent: Monday, July 29, 2013 12:18 AM
To: [email-masked]
Subject: [karp] Call for WG adoption: draft-mahesh-karp-rkmp-04

Yours,
Joel M. Halpern