Re: [karp] [kmart] Automated Key Management for Router Updates

["Thomas Hardjono" <[e-mail]>]

Bill, folks,

I read through the paper -- interesting use of GDOI. 

I'm kind of thinking that the KARP problem has multiple faces/phases
(similar if not identical to the NIST 800-57 lifecycle):

(a) Initialization phase, where all the entities (routers) somehow obtains
the relevant keying material.

(b) Operational phases, where the routers use or exercise the keys.

(c) Maintenance phase, where security maintenance is performed (eg. backup
of keys, migration to new router, re-initialization, etc. etc).

(d) Decommissioning phase, where routers are taken off the network in a
graceful (and secure) way, and their keys logged elsewhere (for legal
purposes) and then nuked.

Many IT folks in medium to large Enterprises dislike having to install and
operate yet another management console (for another part or aspect of their
network and IT). So it would a good design goal for the KARP WG to allow the
resulting KARP protocol to be "integrate-able" to existing network
management consoles (read products) that implement device-management
protocols (eg. WS-Man, DMTF DASH/MASH, etc etc).  Some of these existing
protocols could be used for one or more of the phases above.

For key management specifically, perhaps the KARP WG could look at re-using
the Oasis KMIP work (Key Management Interoperability Protocol). Something
like a router-specific profile could be created. The KMIT spec already
support a number of key formats (packing format), as well as transport
methods.

Thoughts?

cheers,

/thomas/





> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> William Atwood
> Sent: Tuesday, October 27, 2009 9:36 PM
> To: Gregory M. Lebovitz
> Cc: [e-mail]
> Subject: Re: [karp] [kmart] Automated Key Management for Router Updates
> 
> Gregory,
> 
> Yes, I would love to present it, but unfortunately I will not be at
> Hiroshima.  It's not in an Internet Draft yet, either.  Hopefully,
> someone will at least read the paper, and give me comments.  I will
> send Brian and Joel some notes on draft-ietf-pim-sm-linklocal and the
> AKM framework paper, which they can use at their discretion.
> 
>    Bill
> 
> Quoting "Gregory M. Lebovitz" <[e-mail]>:
> 
> > Bill,
> > Did you want to present this at the KARP BOF in Hiroshima? It is
> > definitely related work in progress. Have you published this as an I-D
> > yet? Better speak up now, as the agenda is solidifying quickly.
> >
> > Gregory.
> >
> > At 08:00 PM 7/23/2009, Bill Atwood wrote:
> >> Dear all,
> >>
> >> I have written a paper that outlines the requirements for the
> >> distributed key management part of the "kmart" roadmap, and proposes
> a
> >> distributed Key Server solution.  It has been accepted for
> >> publication/presentation at Emerging 2009 in Malta, October 11--16.
> >>
> >> A preprint of the paper can be accessed via
> >> http://users.encs.concordia.ca/~bill/papers/emerging2009-akm.html
> >>
> >> I welcome comments from any participant in the kmart mailing list (or
> >> anyone else!).
> >>
> >>  Bill Atwood
> >>
> >> --
> >>
> >> Dr. J.W. Atwood, Eng.             tel:   [phone] x3046
> >> Distinguished Professor Emeritus  fax:   [phone]
> >> Department of Computer Science
> >>   and Software Engineering
> >> Concordia University EV 3.185     email: [e-mail]
> >> 1455 de Maisonneuve Blvd. West    http:
> //users.encs.concordia.ca/~bill
> >> Montreal, Quebec Canada H3G 1M8
> >> _______________________________________________
> >> kmart mailing list
> >> [e-mail]
> >> https://www.ietf.org/mailman/listinfo/kmart
> 
> 
> 
> --
> Dr. J.W. Atwood, Eng.             tel:   [phone] x3046
> Professor Emeritus                fax:   [phone]
> Department of Computer Science
>     and Software Engineering
> Concordia University EV 3.185     email: [e-mail]
> 1455 de Maisonneuve Blvd. West    http://www.cse.concordia.ca/~bill
> Montreal, Quebec Canada H3G 1M8
> 
> _______________________________________________
> karp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/karp