Subject: Re: [karp] Shen review, draft-lebovitz-kmart-roadmap-01.txt

From: "Gregory M. Lebovitz" <[email-masked]>
Date: Wed, 04 Nov 2009 02:07:00 -0800

Hey Sean,

Thanks for the review. I'm not sure how it slipped through the 
cracks, but I just came across it in my inbox today, while updating 
the document.  See comments below...
(and note:  I'm cc'ing the new list "KARP", because we moved away 
from the name "kmart"P

At 01:41 AM 3/19/2009, Sean Shen wrote:
>Hi, Gregory,
>I found the draft content is rich and valuable. I have not finished 
>reading all details and have some questions/comments so far, 
>hopefully will fire out more soon.
>
>
>#1.
>The first paragraph of section 3 gives me the feeling that the 
>classification for KMP purpose. I am not sure my understanding is correct.

We do the categorization to try to group problem spaces / solutions. 
This is partly for KMP purpose, but also for how the keys and message 
transactions will need to occur.  Did you have proposed text changes?

>
>#2.
>The classification in Section 3.1. What's the difference between 
>"one-to-one" and "client-server" (in KMP point of view?)? Plan to 
>use out-of-band KMP for one-to-one and in-line KMP for client-server?

You know, I'm not really sure that the distinction is clear enough to 
last. When we originally brainstormed it (we = me, sec AD's, rtg 
AD's, Danny McPherson) we thought of BGP as a clear example of 
one-to-one. And we thought of end-point discovery protocols as 
examples of client-server, or perhaps something like BGP route 
reflector as client-server. One reason they could be different is 
because if one is clearly the client (i.e. a BGP router) and one is 
clearly a server (the route reflector), then a client-server model 
for authentication could be used, where each of the clients is 
configured with the credentials for the server, and the server is 
configured with the credentials of the clients, but not all the 
clients know of each other apriori. Just thinking outlout. We 
definitely need more discussiona dn work on these definitions.

>
>#3
>The requrements for Phase1 update in section 4.2 is critical, are 
>there any priority order?

not really, no.

>Defining what elements should be protected might be done first,

This might well be different for each Routing Protocol.

>some of the work (like what are strong algorithms) are  fairly 
>independent of routing protocols themselfs ,

agreed.

>  some (like rekeying) are not,

agreed, that the exact mechanism will be different per protcol, but 
that the basic way one does this should be pretty consistent, i.e. 
something connection specific used in a KDF along with the Master Key 
which yields a connection specific Traffic Key, and some indication 
of keyID so that each knows which key is being used.

Were you thinking there needs to be text in the document associated 
with these questions? Or are these just clarification for yourself? 
Please feel free to propose text.

>  overall, will there be a schedule?

what type of schedule? There will be milestones associated with the 
WG, once formed. Is that what you meant?

>
>#4.
>For all the keying work in section 4.2, are you refering to 
>currently used keying? Namely, one single manual key, from the 
>survey info in section 1.2.4?

Yes, the requirements there are for Phase 1, which is enhancing the 
Routing Protocol's manual key mechanism so that it can do the things 
listed in 4.2. Once that is done, we can get to work on layering on a KMP.

Please let me know if you think the answers above should in some way 
generate new/different text for the draft.

Thanks again for the review,
Gregory.

>
>Best,
>
>Sean
>
>
>
>
>
>
>
>
>
>----------
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Gregory Lebovitz
>Sent: Tuesday, March 17, 2009 4:12 AM
>To: [email-masked]; [email-masked]; [email-masked]
>Cc: Ross Callon; Tim Polk; Pasi Eronen; Danny McPherson
>Subject: Pls review draft-lebovitz-kmart-roadmap-01.txt
>
>Hey all,
>
>The -01 draft that captures the goals, definition of work, and order 
>of priorities for securing routing protocol transports is here:
> 
><http://www.ietf.org/internet-drafts/draft-lebovitz-kmart-roadmap-01.txt>http://www.ietf.org/internet-drafts/draft-lebovitz-kmart-roadmap-01.txt 
>
>
>This represents joint work of the IAB, RTG and SAAG areas, under the 
>guidance of the ADs of both.
>
>This document will be presented in IETF74 at:
>  - RTG WG
>  - SAAG
>  - SIDR (brief advertisement)
>  - Others ? (pls let me know)
>
>Pls respond with comments to me, and cc the 
><mailto:[email-masked]>[email-masked] mail list.
>
>Gregory.
>
>--
>----
>IETF related email from
>Gregory M. Lebovitz
>Juniper Networks