Subject: [pim] draft-atwood-pim-sm-linklocal

From: Mike McBride <[email-masked]>
Date: Fri, 21 Jul 2006 15:05:52 -0700 (PDT)

draft-atwood-pim-sm-linklocal-01 was presented by Bill Atwood in our wg 
meeting last week. The authors are requesting this work become a wg item. 
It proposes securing the pim control plane beyond what is defined in the 
pim-sm spec. Please review the draft and provide opinions on adoption.

http://www.ietf.org/internet-drafts/draft-atwood-pim-sm-linklocal-01.txt

thanks,
mike

_______________________________________________
pim mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pim

---

From: George Gross <[email-masked]>
Date: Tue, 25 Jul 2006 06:25:53 -0400 (EDT)

Hi Mike,

I took a look at your PIM-SM link local security draft. As part of any
operationally viable solution, I would suggest that automated group key
management is going to be preferred for PIM-SM over manual keying. There
are at least four cases that tilt the table towards this conclusion:

1) Group Speaker PIM-SM router crashes and reboots (note: in your model,
every PIM-SM router is a Group Speaker)

2) Group Receiver PIM-SM router rebooting

3) group key lifetime expiration - good key management hygiene is to
retire keys that have been in use for a period of time (e.g. 24 hours), or
after they've authenticated a given volume of traffic.

4) group key compromise - somebody leaks the group secret authentication
key, we need to replace it immediately.

In the first of these cases, the PIM-SM communications are inoperable
until all of the peer endpoints manually synchronize their IPsec SA
sequence numbers with the rebooted peer PIM-SM router. In all of the above
cases, the PIM-SM communications are interrupted until you manually visit
each PIM-SM router to correct the IPsec SPD/SAD state.

A group key management protocol solves the problems incurred by the above
cases. Rebooting PIM-SM routers must re-register with the Group Controller
Key Server (GCKS) to synchronize their state with the group. The GCKS
announces each global change in group state to its members. Rekeying the
whole group is done by the GCKS using a group rekey protocol such as
Logical Key Hierarchy (e.g. see Appendix A of RFC4535).

So unless the group has only two or three PIM-SM routers, I would be
concerned that a manually keyed group IPsec SA would not be scalable in
practice. That said, it is a good thing that PIM-SM working group is
taking steps to examine how to secure the protocol, and standardizing its
solution would make sense as a working group activity.

BTW, there is an IPsec multicast extensions standards track draft in MSEC
you may wish to look at: draft-ietf-msec-ipsec-extensions-02.txt. This
draft defines the RFC4301 superset needed to support a group key
management protocol.

hth,
	George

P.S. I don't subscribe to the PIM mail list, so if this e-mail bounces and
doesn't appear there, please feel free to forward there on my behalf. thx!

On Fri, 21 Jul 2006, Mike McBride wrote:

> MSEC mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/msec
>