Re: Re: Re: [ssm] SSM with IPSec

[Mark Baugher <mbaugher@cisco.com>]

Toerless,

At 02:08 PM 1/15/2003 -0800, Toerless Eckert wrote:
>Ok, thanks for the insight. One issue is still that the solution
>needs to support the two cases:
>
>    - independent security associations for (S1,G) and (S2,G) if
>      G is an SSM group, because (S1,G) and (S2,G) don't necessarily
>      have a connection.
>    - same security association for (S1,G) and (S2,G) if G is an ASM
>      group.
>
>Now how to determine what kind of security association is needed,
>i don't know. Probably it would be a good thing if that could be determined
>somewhat application specific, but not necessarily requiring the IPsec
>framework to know the distinction between ASM/SSM.

When the security association is pushed down to the member by key 
management, there will need to be a flag that declares whether it is 
indexed with the source address (SSM) or not (ASM), i.e. whether multiple 
sources will share that SA.  We might be able to leave it at this level 
without explicitly declaring it to be ASM or SSM to IPsec.  In fact, this 
would allow ASM groups to be indexed by source address (a separate SA for 
each sender) or SSM to not be indexed by source address (one SA for 
multiple channels).  Whether this makes sense or not is a matter of policy 
that is implemented in the key server.

Mark


>Cheers
>         Toerless

_______________________________________________
ssm mailing list
ssm@ietf.org
https://www1.ietf.org/mailman/listinfo/ssm