Re: [karp] Call for WG adoption: draft-mahesh-karp-rkmp-04

[Joe Touch <[e-mail]>]

On Jul 29, 2013, at 1:23 AM, Sam Hartman <[e-mail]> wrote:

>>>>>> "Russ" == Russ Housley <[e-mail]> writes:
> 
>    Russ> I am confused by the approach taken in this draft.  I only
>    Russ> skimmed it.  We defined a crypto key table, and that document
>    Russ> is close to IESG approval.  I think that IKEv2 should be used
>    Russ> to populate the key table, and then TCP-AO can pull keying
>    Russ> material from the table, as is already described, at least
>    Russ> partially, in the key table document.  Russ
> 
> RKMP is intended to work with the key table draft as you describe.
> With the specific case of TCP-AO there are some additional complexities
> because of abstractions created by the TCP-AO spec.

The complexities are at least partly related to the fact that IKE is based on network (IP) protocols and sequences of streams using the same ports, whereas TCP-AO never reuses connection keys on successive connections to the same ports.

The complexities are non-trivial, and require the introduction of a new mechanism to translate between the expectations of IKE and TCP-AO. draft-mahesh-karp-rkmp describes this mechanism in detail.

> It's certainly intended to be the case that rows are added to the key
> table by RKMP and it's intended to be the case that TCP-AO interacts
> with the key table in a manner similar to how it handles manual keying
> with regard to RKMP.

draft-ietf-karp-crypto-key-table describes some very limited ways in which RKMP might interact with TCP-AO, but those limitations are severe - using one key across all interfaces, e.g. At best, crypt-key-table is dismissive in its support for TCP-AO; at worst, it gives recommendations that could be ill-advised.

This document (draft-mahesh-karp-rkmp) provides a specific mechanism to more completely interface TCP-AO to IKE, where that mechanism compensates for the different assumptions of TCP-AO and IKE regarding connection and key usage. 

(note that mahesh-karp does refer to crypto-key-table, but it adds significantly to it)

Joe