Subject: [karp] On-the-wire security for PIM-SM

From: Bill Atwood <[email-masked]>
Date: Mon, 09 Nov 2009 00:00:44 -0500

Hello,

In keeping with the goals of the KARP effort, I wish to report a small
increment in the achievement of the first phase KARP goals.

draft-ietf-pim-sm-linklocal (Authentication and Confidentiality in
PIM-SM Link-local Communication) defines the router-to-router
(link-local) communication for PIM-SM.  It is currently in IESG Last
Call.  (Any comments from routing or security folks will be appreciated!)

This past summer, a student in my laboratory has implemented the
procedures described in the Internet-Draft.  The XORP (software) router
on Linux-based platforms was used to provide the multicast routing, and
the setkey() function in the Linux kernel was used to manually establish
the keys and parameters for the IPsec multicast security association.
Interestingly, the required security is achieved entirely with IPsec
rules---there was no need to modify the PIM-SM source code.

This fall, another student is duplicating the implementation using
hardware routers.  Given our experience with the software routing, it is
expected that the project will require only the use of the IPsec
commands to achieve the security (at least for manually-specified keys).

The Internet-Draft for PIM-SM security is heavily based on RFC 4552
(Authentication/Confidentiality for OSPFv3).  However, it goes somewhat
beyond RFC 4552 in that it explicitly acknowledges that while manual
keying is all that we can do for now, automated keying is very much
desired in a future revision.  This is in keeping with the second set of
KARP goals.

In the future, we expect to explore possible solutions to the automated
key management issues that form the second phase KARP goals.  I thank
those who commented a couple of weeks ago on my paper about AKM issues.

  Bill

-- 

Dr. J.W. Atwood, Eng.             tel:   +1 (514) 848-2424 x3046
Distinguished Professor Emeritus  fax:   +1 (514) 848-2830
Department of Computer Science
   and Software Engineering
Concordia University EV 3.185     email: [email-masked]
1455 de Maisonneuve Blvd. West    http: //users.encs.concordia.ca/~bill
Montreal, Quebec Canada H3G 1M8

---

From: "Gregory M. Lebovitz" <[email-masked]>
Date: Sun, 08 Nov 2009 21:40:14 -0800

Bill,
Good stuff. Are you presenting this document this week in either 
PIM-SM, or MSEC?

Brian - is this document on your list for the survey you will be 
presenting at the BoF tomorrow?

Gregory.

At 09:00 PM 11/8/2009, Bill Atwood wrote:
>_______________________________________________
>karp mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/karp

---

From: Brian Weis <[email-masked]>
Date: Mon, 9 Nov 2009 22:21:19 +0900

Hi Bill & Gregory,

Thanks for the reminder of the link-local draft. I have added it to  
the Survey of methods for PIM-SM.

Brian

On Nov 9, 2009, at 2:40 PM, Gregory M. Lebovitz wrote:

> Bill,
> Good stuff. Are you presenting this document this week in either PIM- 
> SM, or MSEC?
>

-- 
Brian Weis
Router/Switch Security Group, ARTG, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]

---

From: Bill Atwood <[email-masked]>
Date: Mon, 09 Nov 2009 09:42:35 -0500

As I am not attending IETF 76, I have no presentation planned.

I assume that Mike/Stig will note the IESG Last Call status during the
PIM WG meeting  :-)

  Bill

Mike/Stig: You might want to note the "implementation experience"
reported below, for benefit of those PIM WG members who are not
listening to the karp mailing list.  I leave the decision to you. Bill

Gregory M. Lebovitz wrote:
> Bill,
> Good stuff. Are you presenting this document this week in either PIM-SM,
> or MSEC?
> 

--