Re: [Tcpcrypt] New version of the charter text

[Joe Touch <[e-mail]>]

On 4/23/2014 11:00 AM, John-Mark Gurney wrote:
> marcelo bagnulo braun wrote this message on Wed, Apr 23, 2014 at 19:54 +0200:
>> El 23/04/14 19:18, Joe Touch escribió:
>>>
>>> On 4/23/2014 10:04 AM, marcelo bagnulo braun wrote:
>>> ...
>>>>>> The WG will define the
>>>>>> TCP extensions to perform an unauthenticated key exchange resulting in
>>>>>> encryption
>>>>>> without authentication.
>>>>>
>>>>> This implies in-band.
>>>>
>>>> Yes, the idea here is to provide a fully automatic mechanism, that
>>>> people simply install and dont need to configure keys or anything.
>>>
>>> That is orthogonal as to whether the key exchange is in-band.
>>>
>>> Yes, a key exchange mechanism needs to be defined as part of the
>>> system, but not necessarily inside the connection being protected.
>>
>> mmm, havent considered that.
>> So the key exchange mechanism would be part of the work of the WG, correct?
>>
>> How do you envision doing it other than inside the connection? like
>
> Yes, this would be nice to know...

In-band in a previous connection or completely out-of-band in a 
different protocol (like IKE is to IPsec). You could even do it inside 
the data of a TCP connection and use it on subsequent connections if you 
wanted to keep it "TCP".

>> having a control connection to negotiate these things?
>> (something like
>> https://tools.ietf.org/id/draft-paasch-mptcp-control-stream-00.txt maybe?)
>
> This should be entirely in kernel, as requiring a daemon to pass non-TCP
> traffic before any encrypted TCP traffic can be sent it a bad idea...

It should be integrated and automatic. How that is achieved is 
implementation-dependent, and we shouldn't care other than integrated 
and automatic.

Joe