Re: [karp] [kmart] Automated Key Management for Router Updates

[Brian Weis <[e-mail]>]

Hi Thomas,

On Oct 28, 2009, at 8:00 AM, Thomas Hardjono wrote:

> Bill, folks,
>
> I read through the paper -- interesting use of GDOI.
>
> I'm kind of thinking that the KARP problem has multiple faces/phases
> (similar if not identical to the NIST 800-57 lifecycle):
>
> (a) Initialization phase, where all the entities (routers) somehow  
> obtains
> the relevant keying material.
>
> (b) Operational phases, where the routers use or exercise the keys.
>
> (c) Maintenance phase, where security maintenance is performed (eg.  
> backup
> of keys, migration to new router, re-initialization, etc. etc).
>
> (d) Decommissioning phase, where routers are taken off the network  
> in a
> graceful (and secure) way, and their keys logged elsewhere (for legal
> purposes) and then nuked.

That's a good overview of life cycle key management, and it might be a  
good topic for the OPSEC WG.

>
> Many IT folks in medium to large Enterprises dislike having to  
> install and
> operate yet another management console (for another part or aspect  
> of their
> network and IT). So it would a good design goal for the KARP WG to  
> allow the
> resulting KARP protocol to be "integrate-able" to existing network
> management consoles (read products) that implement device-management
> protocols (eg. WS-Man, DMTF DASH/MASH, etc etc).  Some of these  
> existing
> protocols could be used for one or more of the phases above.
>
> For key management specifically, perhaps the KARP WG could look at  
> re-using
> the Oasis KMIP work (Key Management Interoperability Protocol).  
> Something
> like a router-specific profile could be created. The KMIT spec already
> support a number of key formats (packing format), as well as transport
> methods.

Thanks for pointing out this work. A KARP WG (should it be formed)  
could consider the KMIP key when it begins work on automated key  
management. However, specifying the use of (or changes to) protocols  
developed outside of the IETF might be an issue. I'd welcome further  
thoughts on this once a WG is formed and thinking about automated key  
management.

Thanks,
Brian

>
> Thoughts?
>
> cheers,
>
> /thomas/
>
>
>
>
>
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]] On  
>> Behalf Of
>> William Atwood
>> Sent: Tuesday, October 27, 2009 9:36 PM
>> To: Gregory M. Lebovitz
>> Cc: [e-mail]
>> Subject: Re: [karp] [kmart] Automated Key Management for Router  
>> Updates
>>
>> Gregory,
>>
>> Yes, I would love to present it, but unfortunately I will not be at
>> Hiroshima.  It's not in an Internet Draft yet, either.  Hopefully,
>> someone will at least read the paper, and give me comments.  I will
>> send Brian and Joel some notes on draft-ietf-pim-sm-linklocal and the
>> AKM framework paper, which they can use at their discretion.
>>
>>   Bill
>>
>> Quoting "Gregory M. Lebovitz" <[e-mail]>:
>>
>>> Bill,
>>> Did you want to present this at the KARP BOF in Hiroshima? It is
>>> definitely related work in progress. Have you published this as an  
>>> I-D
>>> yet? Better speak up now, as the agenda is solidifying quickly.
>>>
>>> Gregory.
>>>
>>> At 08:00 PM 7/23/2009, Bill Atwood wrote:
>>>> Dear all,
>>>>
>>>> I have written a paper that outlines the requirements for the
>>>> distributed key management part of the "kmart" roadmap, and  
>>>> proposes
>> a
>>>> distributed Key Server solution.  It has been accepted for
>>>> publication/presentation at Emerging 2009 in Malta, October 11--16.
>>>>
>>>> A preprint of the paper can be accessed via
>>>> http://users.encs.concordia.ca/~bill/papers/emerging2009-akm.html
>>>>
>>>> I welcome comments from any participant in the kmart mailing list  
>>>> (or
>>>> anyone else!).
>>>>
>>>> Bill Atwood
>>>>
>>>> --
>>>>
>>>> Dr. J.W. Atwood, Eng.             tel:   [phone] x3046
>>>> Distinguished Professor Emeritus  fax:   [phone]
>>>> Department of Computer Science
>>>>  and Software Engineering
>>>> Concordia University EV 3.185     email: [e-mail]
>>>> 1455 de Maisonneuve Blvd. West    http:
>> //users.encs.concordia.ca/~bill
>>>> Montreal, Quebec Canada H3G 1M8
>>>> _______________________________________________
>>>> kmart mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/kmart
>>
>>
>>
>> --
>> Dr. J.W. Atwood, Eng.             tel:   [phone] x3046
>> Professor Emeritus                fax:   [phone]
>> Department of Computer Science
>>    and Software Engineering
>> Concordia University EV 3.185     email: [e-mail]
>> 1455 de Maisonneuve Blvd. West    http://www.cse.concordia.ca/~bill
>> Montreal, Quebec Canada H3G 1M8
>>
>> _______________________________________________
>> karp mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/karp
>
> _______________________________________________
> karp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/karp


-- 
Brian Weis
Router/Switch Security Group, ARTG, Cisco Systems
Telephone: [phone]
Email: [e-mail]