Re: [tcpm] TCP-AO: Text for New_Key Process

At Thu, 29 Jan 2009 21:28:47 -0600,
Eddy, Wesley M. (GRC-RCN0)[VZ] wrote:
> 
> I mostly agree with Joe, and have some brief comments below:
> >My view is that TCP-AO MUST support a mechanism for key coordination -
> >which I believe was consensus in the design team at least.
> >
> >I prefer TCP-AO not to include that mechanism internally, to 
> >keep things
> >simple. That's just a preference, though.
> >
> >I do think that mechanisms that couple tightly to a particular segment
> >exchange should be out of scope, however.
> >
> 
> 
> The direction that we were always heading in was that TCPM will make
> sure the spec for AO permits automated changes of keys and won't be
> breaking other parts of TCP in the meantime.  We understood that
> "permiting" or "supporting" the changeover in AO didn't mean actually
> being responsible for doing it all inside the TCP connection, and that
> the SECDIR would define a separate mechanism (not inside TCP) for this.

Not to put too fine a point on it, that hasn't happened, nor, years
later, is there anything even approaching the beginnings of an effort
towards secdir designing anything (as if secdir could design
anything), or (more realistically) an effort starting up to do so. The
manual keying stuff is it for the foreseeable future.

> To be done timely and without bugs, AO has to stay as simple as the
> needed security properties permit, so I have to agree with Joe.

Well, since the basic security property that people wanted was to be
able to change keys without breaking the connection, it seems to me
that it's important for it to actually work in some useful way.
Certainly, one could claim that having automatic switchover isn't
(e.g., that multiple phone calls to change a key is OK) important or
that Joe's suggestion gets the job done, but I don't think it's
realistic to claim that some putative automatic key management
mechanism is going to suddenly appear and make this problem go away.

-Ekr

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm