[dtn-interest] BSP and key management

["Peter Lovell" <[e-mail]>]

The first open issue relates to how we handle key management.

Various of us have different ideas of exactly what it means -- what's in
and what's not. And each of these has a number of component parts.

One obvious component is some kind of information-store or database
where keys or key-material are saved. There are also the processes for
interacting with local users of the key storage, forming what might be
called a "key service". Another is the interaction mechanism for a key-
service at one location and a remote key-service at another.

My goal is for this thread to decide which things should go into BSP
specification and which should more properly be in the new KM spec
initiated by Stephen 
<http://www.ietf.org/internet-drafts/draft-farrell-dtnrg-km-00.txt> 
and then reach closure on at least the BSP portions.

>From the BSP standpoint, I see two main items:-
1. what minimum capability is required in support of the mandatory
ciphersuites
2. what does key material look like in a bundle

The term "key material" used for a bundle is expansive and encompasses
all the keys and related "stuff" such as certificates, IVs, signatures,
key references or identifiers, etc etc.

The other requirements and characteristics seem to be better placed in
the KM spec, things like:-
1. key-wrap using symmetric and assymetric keys
    (algorithms, procedures etc)
2. rules for storage (protection) and usage of key material
3. key exchange and/or negotiation protocol between nodes
    (BSP itself never negotiates keys)


Thanks.....Peter

p.s. we only look at KEKs here, not traffic keys