Re: [dtn-interest] BSP and key management

Good that we're starting on this (and well done with the
BSP code!).

Something that might be attractive here is TESLA. [1] I
reckon it, or some variant, might be an interesting way
of versioning keys based on symmetric crypto.

Whatcha think?
S.

[1] http://www.ietf.org/rfc/rfc4082.txt

Peter Lovell wrote:
> The first open issue relates to how we handle key management.
> 
> Various of us have different ideas of exactly what it means -- what's in
> and what's not. And each of these has a number of component parts.
> 
> One obvious component is some kind of information-store or database
> where keys or key-material are saved. There are also the processes for
> interacting with local users of the key storage, forming what might be
> called a "key service". Another is the interaction mechanism for a key-
> service at one location and a remote key-service at another.
> 
> My goal is for this thread to decide which things should go into BSP
> specification and which should more properly be in the new KM spec
> initiated by Stephen 
> <http://www.ietf.org/internet-drafts/draft-farrell-dtnrg-km-00.txt> 
> and then reach closure on at least the BSP portions.
> 
>>From the BSP standpoint, I see two main items:-
> 1. what minimum capability is required in support of the mandatory
> ciphersuites
> 2. what does key material look like in a bundle
> 
> The term "key material" used for a bundle is expansive and encompasses
> all the keys and related "stuff" such as certificates, IVs, signatures,
> key references or identifiers, etc etc.
> 
> The other requirements and characteristics seem to be better placed in
> the KM spec, things like:-
> 1. key-wrap using symmetric and assymetric keys
>     (algorithms, procedures etc)
> 2. rules for storage (protection) and usage of key material
> 3. key exchange and/or negotiation protocol between nodes
>     (BSP itself never negotiates keys)
> 
> 
> Thanks.....Peter
> 
> p.s. we only look at KEKs here, not traffic keys
> 
> 
> 
> _______________________________________________
> dtn-interest mailing list
> dtn-interest@mailman.dtnrg.org
> http://maillists.intel-research.net/mailman/listinfo/dtn-interest
> 