FW: COPS-TLS extensions

Forwarding to the list for comments.

Amol

-----Original Message-----
From: [email protected] [mailto:[email protected]]=20
Sent: Tuesday, July 29, 2003 8:10 PM
To: Kulkarni, Amol
Cc: [email protected]
Subject: RE: COPS-TLS extensions

Hello

The first extension is a "Session Re-Negotiation Timer=20
Object". It consists of a 2 byte field indicating the=20
duration after which a TLS session must be renegotiated=20
between PEP and PDP. It also consists of a single byte flag=20
that indicates if session re-use is permitted. The object=20
would be appended to a Client-Accept message sent from the=20
TLS enabled PDP.

The second is a "Session Re-Negotiation Required" message.=20
This will be a new COPS message ( arbitrary opcode ) that=20
contains a Session Re-Negotiation Timer Object. It will be=20
issued by the PDP when TLS re-keying must be performed=20
within the bounds of the time limit set in the initial=20
Session Re-Negotiation object in the Client-Accept. It would=20
be issued in the case that keying material is/may be=20
compromised, and immediate rekeying is required.=20

The final ( largely experimental ) extension is=20
a "Enable/Disable Cipher Mode" message. It will consist of a=20
new object that consists of 2 byte fields. The first field=20
identifies a COPS message op-code, the second is a flag with=20
values 0/1. The idea of the message is that it will be=20
issued by either a PEP or PDP prior to sending, for example,=20
a Report-State message that contains significant amounts of=20
data ( 10's of MBs e.g. a large firewall log ). When the=20
flag is set to 1, all subsequent COPS message that match the=20
designated opcode will not be encrypted ( i.e a TLS=20
handshake will be performed to disable encryption ). When it=20
is set to 0, only the next COPS message that matches the=20
opcode will not be encrypted. The idea will be to reduce=20
processing requirements on low powered devices or heavy=20
burdened PDPs when sending or receiving large amounts of=20
data. e.g for a small mobile PEP device that uses COPS-PR to=20
obtain its firewall policies, it may be necessary to have=20
policy decisions encrypted but large report state messages=20
can be left in plain text form.