Subject: Agenda Items for SLC?

From: Derek Atkins <[email-masked]>
Date: 19 Nov 2001 17:45:07 -0500

December is quickly approaching.  The KINK-WG is meeting Monday
monring at 9am.  Anybody have specific items for the Agenda?

All I've got right now is a Status Update from Mike Thomas.
Anything else?

-derek
-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: Michael Thomas <[email-masked]>
Date: Tue, 20 Nov 2001 09:34:52 -0800 (PST)

I think that we should spend some time talking
about the new Son of IKE requirements draft and
how we compare. The one thing that jumps out at me
is how to deal with vendor and/or ISAKMP
extensions. The draft is currently silent about
that.

		Mike

---

From: Derek Atkins <[email-masked]>
Date: 20 Nov 2001 12:59:24 -0500

Are you willing to lead (or delegate) both of these discussions?
Is there someone else who wants to discuss it?

-derek

Michael Thomas <[email-masked]> writes:

> Derek Atkins writes:
>  > Michael Thomas <[email-masked]> writes:
>  > 
>  > Considering the SoI draft will be discussed at IPsec, do others
>  > feel it is reasonable to discuss it in KINK?  What benefit would
>  > a discussion in KINK bring to the table?  Not that I think it's
>  > a bad thing to discuss, I just want to understand the relevance
>  > to the KINK work.
> 
>    I'm not proposing that we discuss SOI requirements
>    as they relate to a SOI. I know that I've tried to
>    be pretty sensitive to the known shortcomings
>    of IKE so that we don't wander into the same
>    traps needlessly. I _think_ we've accounted for
>    many/most of them, but I'd like to believe
>    others have the same feeling.
> 
>  > As for Vendor and ISAKMP extensions, have said extensions ever been
>  > made to phase-II?  Talking about a KINK extension infrastructure is
>  > reasonable.
> 
>    I believe so. I think that mode config is a
>    phase II creature, though I'm not positive. 
>    I'm honestly not up to speed with what the
>    difficulties were here, so it's hard for me
>    to evaluate where we stand.
> 
> 	       Mike

---

From: Michael Thomas <[email-masked]>
Date: Tue, 20 Nov 2001 09:55:33 -0800 (PST)

Mike

---

From: Jan Vilhuber <[email-masked]>
Date: Tue, 20 Nov 2001 12:35:52 -0800 (PST)

>    phase II creature, though I'm not positive. 

It's neither. It's a phase 1.5 creature, and horribly deformed one at that.

I seem to remember that kerberos tickets can contain a certain amount of
authorization data (although I could be wrong). config-mode is nothing other
than authorization data (here's an ip address, here's a dns address, etc,
i.e. as in the 2nd 'A' in AAA). It should be excluded from key management
protocols entirely, in my opinion. Carry it in kerberos, or use a secondary
protocol to carry such information (dhcp, cops, radius, etc...). Some things
that are needed to bootstrap the connection (like ip address) may be needed,
but not in an extensible fashion, since otherwise people want to start
sending whole router configs via config-mode; don't laugh.. I see this as we
speak in some areas..

jan

 --
Jan Vilhuber                                            [email-masked]
Cisco Systems, San Jose                                     (408) 527-0847

---

From: Derek Atkins <[email-masked]>
Date: 20 Nov 2001 12:43:34 -0500

-derek