Re: [Secdispatch] Controller-IKE

Hi Dave,

Thanks for sharing this work.  This seems like an interesting problem to
compare with IKE/TLS and MLS -- where IKE and TLS are about configuring a
1-1 security context and MLS is about establishing a single security
context across N participants, the goal here seems to be to maintain a full
matrix of N^2 security contexts with sub-linear messaging to update a
row/column.

Given that different shape, it seems like the association with IKE is
pretty tenuous.  It might be clearer to consider this an alternative to IKE
for this mesh case, in the sense of being an external key exchange protocol
that results in the production of IPsec SAs.

It would be helpful to have a clearer idea of the security objectives here,
especially around things like forward security and post-compromise
security.  The obvious objective of providing equivalent assurances to a
collection of N^2 individually negotiated SAs seems unlikely to be feasible
here.  In particular, the protocol in the current document doesn't provide
it, since multiple SAs are "fate shared" due to key reuse -- if an attacker
compromises one peer's DH key, then a whole "row" of SAs are compromised.

--Richard

On Fri, Jul 19, 2019 at 10:20 PM David Carrel (carrel) <carrel@cisco.com>
wrote:

> Folks,
>
>
>
> I would like to present Controller-IKE in the Montreal Security Dispatch
> meeting.  There is growing interest from routing folks, and I strongly feel
> we should evaluate and progress this in the security area.  I’ll have some
> slides to share shortly.  For now, please do read the draft.  Also there
> are some drafts referencing this:
>
>
>
> Controller-IKE:
> https://tools.ietf.org/html/draft-carrel-ipsecme-controller-ike-01
>
>
>
> Also some docs referencing this form of key management:
>
> BESS, Secure EVPN:
> https://tools.ietf.org/html/draft-sajassi-bess-secure-evpn-02
>
> And: https://tools.ietf.org/html/draft-dunbar-bess-bgp-sdwan-usage-01
>
>
>
> Comments appreciated.
>
>
>
> Dave
>
>
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch
>