Re: [pcp] Posted auth req slide that was edited during meeting

Dear all:

I have been trying to understand the requirement 4) but I have failed (probably my problem).

Let me share my view about this.

A security association (SA) is the result of the establishment of some sort of shared security context between two (or more) network entities to perform secure communications. We have IPsec SA, IKE SA, TLS SA, etc... These entities share a security context which imply to share fresh cryptographic material.

So, to me, the statement "Server can use expired SA for a given mapping to protect any unsolicited unicast message it sends regarding that mapping " seems wrong under a security standpoint (maybe it is not intention of the sentence or I do not understand it)

A expired SA means it is not a fresh SA and therefore not valid. Using it creates a security issue.

Apart from this, I was wondering... what is the expiration time of a "expired" SA? Or, in other words, when the "expired" SA is really expired? Is the lifetime set to infinite? If it isn't, how is the extended lifetime SA set? 

This is really confusing to me. As also said in the meeting, then we are not talking about an expired SA.

I believe I also heard in the audio that there were real examples where an expired SA is used. I would like to know some of them. AFAIK, IPsec SA, IKE SA, etc... do not proceed like this way. Is there any standard secure protocol that allows this and it is considered secure?

An example about the usage of certificates was also given. A certificate is a credential. So I do not know how this example applies.

I would really appreciate any clarification.

Best regards.
El 14/03/2013, a las 20:19, Dave Thaler escribió:

> I just uploaded the slide started editing during the meeting into the proceedings:
> http://www.ietf.org/proceedings/86/slides/slides-86-pcp-18.pdf
>  
> During the meeting the chairs heard rough consensus to use option 4 as the
> basis on which to start the discussion on the list.   Feel free to point out problems
> with it.
>  
> -Dave
> _______________________________________________
> pcp mailing list
> pcp@ietf.org
> https://www.ietf.org/mailman/listinfo/pcp

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34868888501 Fax: +34868884151 e-mail: rafa@um.es
-------------------------------------------------------