Subject: SPI list question

From: [email-masked]
Date: Mon, 15 Nov 1999 12:19:31 +0200

Hello!

I have been studying the SLP authentication and I have a
question about using SPIs in the service requests.
I use an example to clarify the case.
Let's say we have a DA that supports SPIs 1,2,3 and 4
Then we have a SA that supports SPIs 3 and 4.
Furthermore, we have an UA that happens to support SPIs 1,2,3.
Now if the UA want's to get the service provided by the SA, and
authenticate that, it has to include the SPI 3 in the SrvRqst.

The question is that how does the UA know what SPI to use?
It is possible to inclue only one SPI in the SrvRqst message. 
Or is it so that the UA has to make a kind of convergence 
algorithm and post one SrvRqst for all the SPIs it supports (1,2,3)?
I.e. three requests and then inspect the results of those.
This at least increases the network traffic.
Or am I missing something here? Is there some specific reason to
have only one SPI in the request?

	Regards, Jari Kinnunen

---

From: James Kempf <[email-masked]>
Date: Tue, 16 Nov 1999 10:07:24 -0800 (PST)

>have only one SPI in the request?

Without preconfiguration, the UA cannot know that it should use SPI 3, so it 
would have to try all of them, or at least keep trying until it got a 
positive response. If the UA was preconfigured with a particular SPI, it would 
use that one. Obviously, preconfiguration is preferred here.

If no DA is in place, the UA can either use an SAAdvert to determine
what SPIs are supported by the SAs, and then only include one of them 
in the request (preferred in the absence of preconfiguration),
or it can simply take its chances by multicasting with an SPI it supports.

There are no fields in the DHCP options to configure an SLP agent with
SPIs. I don't know exactly why that is, it may have been an oversight
or it may be because, until recently, there was no security in DHCP.
Agent SPIs must be configured in an implementation specific manner
(which may include a vendor-specific DHCP option in the still-underway
secure DHCP). This may be an issue we can revisit when SLP goes
to draft standard.

The reason for including only one SPI in the request was to reduce
complexity. The situation as you describe suggests that the SLP network be 
configured to minimize the number of deployed SPIs, and that agents,
especially UAs, be preconfigured with SPIs. This suggests having a DA that 
supports only one SPI if possible, or possibly two if a rekeying or some other 
administrative operation is underway to change SPIs. SLPv1 allowed more 
than one SPI (actually, a protected scope) and it resulted in some
unnecessary complexities of implementation and deployment scenerios.

		jak