Subject: Draft minutes from KINK meeting in London

From: Derek Atkins <[email-masked]>
Date: 24 Aug 2001 14:02:59 -0400

Sorry for getting these out so late.  My thanks to Bill Sommerfeld
for taking these minutes (and getting them to me a LONG time ago!)

Let me know if there are any mistakes or omissions.

-derek

KINK meeting, 1pm 2001/08/09, Blenham room

agenda bashing

protocol update (michael thomas)
	draft status
	changes done:
 		added status command (for QM notifications)
		make use of QM explicit
		clarified padding rules
			hopefully the same as ISAKMP
		added valid kerberos errors, plus a KINK internal error type
			errors copied from RFC1510
			perhaps need more guidance on error recovery
		header rearranged a bit
			reserve some bits for something mike can't remember
		added PFS, security considerations
			per consensus of last meeting
		clarified U-U and Encryption wording
		misc others (noted in the draft)
	to do:
		general editorial pass
		MUST/SHOULD ..
		Last Call soon?
	
	implementation status

		cisco implementation under way for past month
		relatively few snags from draft
		cross between FreeS/Wan Pluto (ISAKMP) and kerberos
			-> named "goofy"
		most MUST/SHOULD features implemented
			General: Create/Delete/Status/GetTGT

		still need optimistic keying and integration with pluto

	quick mode sanity check:
		- use quick mode payloads, but isn't quick mode per se.
		- uses ID, SA, Nonce, and KE
		- does not use HASH or ISAKMP header
		- Nr (responder nonce) is optional
		- use Quick Mode payload ordering.

	issues:
		- are KINK payloads registered as ISAKMP payloads?
		- Diffie-Hellman group for PFS
			put in KE payload?
		Tero Kivinen:
			IKE phase 2 PFS group is actually in the quick 
			mode SA payload
		- More errors?
			- finer-grained 

		- Default service
			ipsec/f.q.d.n@REALM
			jason thorpe suggests "kink/...@REALM"

			sam hartman regarding host principal vs. service princ.
			points to kerberos FTP..

			thor simon: host vs. service-specific:
			tradeoff is: do you force the admin to put
			more stuff in the KDC database, or do you let
			compromise of one of the other services also
			comprimise KINK

			apparent consensus: don't reuse host princ.

		- Hash/Encryption and IPsec SKEYID uses service key
			using subkey might be more appropriate,
			but use of nonces make this roughly equivalent.
			seems to be OK with everyone to do our own key
			derivation based on service key and nonces..
		
	Ack reliability (extended discussion)
		[different from ISAKMP]

		wording about optimistic create, pessimistic delete needed 

		wording about consequences of ACK being dropped..

		SA creation: don't want to install outbound SA until
		the other side has inbound installed..

		options: install SA after timeout anyway?

			initiate back?

			tero/sommerfeld: retransmit both msg 1 and msg 2
			
			sommerfeld: both ends retransmitting leads to
			risk of sorceror's apprentice problem, but
			exchange is short..
			
		extended discussion ensued regarding 2 vs. 3 msg
		exchanges for create..
			
		no problem with 2-msg exchange for anything
		other than CREATE..

		several alternatives discussed for CREATE..
		
		- for CREATE, if short circuit, skip ack.
			(short-circuit == responder picked
			first choice and did not add a nonce)
			(no consensus for/against)

		- for CREATE, w/o short circuit (responder
		injects nonce or picks something other than
		the first proposal).
			unanimous: always send ACK..

	suggestions (no consensus):

		always require server to supply nonce data?
		tradeoff (always forces 3 message exchange, but avoids 
		a config knob..)

		add verbiage to the draft ("if you have a bad RNG on
		the initiator, a good RNG on the responder won't save
		you..")

	2 message exchange as worthy goal??
		(sense of WG: leaning towards yes, but not clear)

	some discussion of acks vs dead peer detection and loss of
		synchronization..

	some discussion of whether ack is actually necessary..
		seems to be down to "nuke it" vs "need to think about it.."

	need more verbiage in documents on when to install SA's.

open discussion?

	nothing more..

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available