Re: Status of Seamoby drafts

I think that if each router shares a symmetric security association with
each other router, secured by a shared key, and there are n routers, the
total number of keys is sum i over n-1 to 0 ( i ). 5 routers require 4 + 3 +
2 +1 keys, 3 routers require 2 + 1 keys, etc. I agree that it is a lot less
than n(n-1), I don't know where he got that number. I think the point he is
trying to make is that a symmetric keying scheme would result in a
configuration problem for a large network.

But my response to him is that it isn't a problem for this document to
solve, at least, not yet. I don't think we need to engage him on the
accuracy of his estimate.

            jak


----- Original Message ----- 
From: "Rajeev Koodli" <[email protected]>
To: "Vijay Devarapalli" <[email protected]>
Cc: "James Kempf" <[email protected]>; <[email protected]>
Sent: Friday, July 16, 2004 3:23 PM
Subject: Re: [Seamoby] Status of Seamoby drafts


>
> Vijay, Jim,
>
> Vijay Devarapalli wrote:
>
> > > Since context transfer security is an n by n problem, establishing the
SAs
> > > to protect inter-router transfers is not an easy thing.  For this
reason one
> > > might conclude that pre-shared keys are difficult, since n(n-1) of
them
> > > would be necessary.  On the other hand, is it being suggested that
each
> > > router needs to be provisioned with a certificate? On reading the
draft it
> > > isn't clear what's being recommended (or even considered).
> >
>
> I could not parse the "n by n" problem. Any pointers ?
> Why is the order higher than pairwise SA between routers, which might
> already exist ?
>
> -Rajeev
>
>
> >
> > this comment is valid. but since we assume the access routers are
> > part of the same administrative domain, they are provisioned with
> > the required certificates to run IKE. (?)
> >
> > Vijay
> >
> > _______________________________________________
> > Seamoby mailing list
> > [email protected]
> > https://www1.ietf.org/mailman/listinfo/seamoby
>
>