Subject: [ipcdn] Next release BPI+ MIB change notes

From: "Eduardo Cardona" <[email-masked]>
Date: Mon, 15 Nov 2004 13:22:41 -0700

Hi all,
Please find attached the MIB objects changes for the next revision of
BPI+ MIB module.
 
IESG revised and made comments in the IPDN MIB module draft 14
 
Here is a summary of the changes:
We are adding additional enumerations for the MIB definitions of
encryption and integrity algorithms of TEKs
 
For TEK Encryption: CBC mode for  3DES 128 bits key and AES 128 and 256
bit keys
For TEK Integrity message also HMAC SHA1 is added to the corresponding
enumeration  
Currently BPI+ spec does not support such cipher suites, so the
appropriate compliance statements are included. 
The security considerations also will reflect the recommendation of
using strong data encryption as outlined by the MIB.

Changes Details:
4 Data Encryption objects (CM/CMTS) are in the MIB module
4 Data Authentication objects (CM/CMTS) are in the MIB module
 
Define two textual Convention for both cases :
DocsBpkmSAType, DocsBpkmDataEncryptAlg
 
Added Compliance Statements to CM and CMTS compliances to indicate
compliance based on current BPI+ spec requirements.

The changes are quite straight and If we all agree in the proposed
changes by Thursday Nov 18, the MIB will be posted Friday Nov 19.  

Security Section 
Removed the TEK lifetime shortening as a way to "improve"
confidentiality.
IESG comments in that respect were it will not stop non-real time data
de-cryption :
 
BPI+ Encryption Algorithms:

BPI+ Traffic Encryption Keys TEK (see [1]) uses DES 

(Data Encryption Standard) 56 or 40 bits encryption ciphers  and no 

data Intergrity algorithms.

Due DES cryptographic strength weakness, future revisions of BPI+ 

specification [1] should introduce advanced encryption algorithms 

as described in DocsBpkmDataEncryptAlg textual convention to overcome

the progress in cheaper and faster  hardware that makes feasible 

brute-force DES decryption.  

To prevent  data tampering BPI+ spcification [1] should adopt Message  

integrity schemas as described in DocsBpkmDataAuthentAlg textual
convention.

Let me know any comments. 
Thanks

Eduardo

 ---Original Message-----
From: Richard Woundy @ Comcast 
Sent: Monday, November 01, 2004 2:01 PM
To: [email-masked]'
Subject: [ipcdn] Updates to IPCDN internet-drafts

	Folks,
	 
	See http://www.ipcdn.org/ipcdn-ids.html
<http://www.ipcdn.org/ipcdn-ids.html>  for updates about the current
internet-drafts under development in the IPCDN WG. I have tried to
update the status of all drafts, and have included a number of new
useful per-draft links (i.e. "See current IESG status").
	 
	Please send any comments and corrections to me.
	 
	-- Rich

_______________________________________________
IPCDN mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipcdn