IP Key Management

  What is key management and what is the group's charter for key
  management?

    o  A protocol and cryptographic technique

    o  Application layer protocol for IPSP

    o  Independent of IPSP

    o  Initially supporting public key techniques

    o  Later adding Key Distribution Center (e.g., Kerbos) and/or
       manual

========

Requirements of IKMP

  The basic functions of the IKMP are to:

    o  create,

    o  manage, and
  
    o  remove security associations

  used by the IP Security Protocol (IPSP) or other similar security
  protocols.

  A security association consists of:

    o  the key(s) used for that association as well as

    o  attributes guiding the operation of the associated protocol.

  In particular, the IKMP is expected to handle negotiation of:

    o  cryptographic algorithms,

    o  protocol format, and

    o  protocol options (e.g., security labels, integrity checks).

========

IKMP Functional Requirements

  Functional requirements for IKMP include:

    o  Security Association ID (SAID) assignment (or Security
       Association-Creation)

    o  Key generation/distribution

    o  Attribute Negotiation

    o  Terminate/Delete Association

    o  Security Association Maintenance

    o  Peer Discovery and Authentication

    o  Recovery

    o  Protocol Profile

    o  Multiparty Associations Key Management

========

Preliminary Experimental Implementations of IKMP

  o  Implementation by Phil Karn

  o  Diffe-Hellman Key Exchange

  o  Designed to limit denial of service

========

Other Key Management Work

  Existing work we might be able to take advantage of:

    o  SDNS KMP - Missing some things like algorithms

    o  IEEE 802.10C - Draft form, based on GULS

    o  ISO GULS - Generic envelopes, very complex, no specific
       algorithms or option negotiation

    o  PEM - Not real-time, but does address certificates

    o  PGP

    o  X.509 - IPSEC will likely use X.509 certificate formats

    o  X9.17 - Private keys, now working on public keys

    o  SAMP - 2nd generation SDNS KMP, may be posted to net soon

    o  SAEP - Embedded in NLSP, network layer protocol

    o  Kerberos - Private keys centrally managed

    o  CATS-GSSAPI - IPSP KMP might be able to use their interface to
       pass information to IPSP; also an outstanding question of whether
       IPSP will meet their needs from a user perspective

========

IKMP Issues

  o  Device name and address implications for directories and 
     certificates

  o  Can a SA change, or is a change accomplished by terminating an 
     old SA and establishing a new one??

  o  Shared keys - used for multicast or (possibly) multiple IPSP
     routers serving a site

  o  Relationship to other IETF Key Management related activities!