datatracker.ietf.org
Sign in
Version 5.4.0, 2014-04-22
Report a bug

The Group Domain of Interpretation
RFC 3547

Document type: RFC - Proposed Standard (July 2003)
Obsoleted by RFC 6407
Document stream: IETF
Last updated: 2013-03-02
Other versions: plain text, pdf, html

IETF State: (None)
Consensus: Unknown
Document shepherd: No shepherd assigned

IESG State: RFC 3547 (Proposed Standard)
Responsible AD: Steven Bellovin
Send notices to: <canetti@watson.ibm.com>, <thardjono@verisign.com>

Network Working Group                                         M. Baugher
Request for Comments: 3547                                       B. Weis
Category: Standards Track                                          Cisco
                                                             T. Hardjono
                                                                Verisign
                                                               H. Harney
                                                                  Sparta
                                                               July 2003

                  The Group Domain of Interpretation

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

Abstract

   This document presents an ISAMKP Domain of Interpretation (DOI) for
   group key management to support secure group communications.  The
   GDOI manages group security associations, which are used by IPSEC and
   potentially other data security protocols running at the IP or
   application layers.  These security associations protect one or more
   key-encrypting keys, traffic-encrypting keys, or data shared by group
   members.

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
       1.1.  GDOI Applications. . . . . . . . . . . . . . . . . . . .  5
       1.2.  Extending GDOI . . . . . . . . . . . . . . . . . . . . .  5
   2.  GDOI Phase 1 protocol. . . . . . . . . . . . . . . . . . . . .  6
       2.1.  ISAKMP Phase 1 protocol. . . . . . . . . . . . . . . . .  6
             2.1.1.  DOI value. . . . . . . . . . . . . . . . . . . .  6
             2.1.2.  UDP port . . . . . . . . . . . . . . . . . . . .  6
   3.  GROUPKEY-PULL Exchange . . . . . . . . . . . . . . . . . . . .  6
       3.1.  Authorization. . . . . . . . . . . . . . . . . . . . . .  7
       3.2.  Messages . . . . . . . . . . . . . . . . . . . . . . . .  7
             3.2.1.  Perfect Forward Secrecy. . . . . . . . . . . . .  9
             3.2.2.  ISAKMP Header Initialization . . . . . . . . . .  9

Baugher, et. al.            Standards Track                     [Page 1]
RFC 3547             GDOI Domain of Interpretation             July 2003

       3.3.  Initiator Operations . . . . . . . . . . . . . . . . . . 10
       3.4.  Receiver Operations. . . . . . . . . . . . . . . . . . . 11
   4.  GROUPKEY-PUSH Message. . . . . . . . . . . . . . . . . . . . . 11
       4.1.  Perfect Forward Secrecy (PFS). . . . . . . . . . . . . . 12
       4.2.  Forward and Backward Access Control. . . . . . . . . . . 12
             4.2.1.  Forward Access Control Requirements. . . . . . . 13
       4.3.  Delegation of Key Management . . . . . . . . . . . . . . 14
       4.4.  Use of signature keys. . . . . . . . . . . . . . . . . . 14
       4.5.  ISAKMP Header Initialization . . . . . . . . . . . . . . 14
       4.6.  Deletion of SAs. . . . . . . . . . . . . . . . . . . . . 14
       4.7.  GCKS Operations. . . . . . . . . . . . . . . . . . . . . 15
       4.8.  Group Member Operations. . . . . . . . . . . . . . . . . 16
   5.  Payloads and Defined Values. . . . . . . . . . . . . . . . . . 16
       5.1.  Identification Payload . . . . . . . . . . . . . . . . . 17
             5.1.1.  Identification Type Values . . . . . . . . . . . 18
       5.2.  Security Association Payload . . . . . . . . . . . . . . 18
             5.2.1.  Payloads following the SA payload. . . . . . . . 19
       5.3.  SA KEK payload . . . . . . . . . . . . . . . . . . . . . 19
             5.3.1.  KEK Attributes . . . . . . . . . . . . . . . . . 22
             5.3.2.  KEK_MANAGEMENT_ALGORITHM . . . . . . . . . . . . 22
             5.3.3.  KEK_ALGORITHM. . . . . . . . . . . . . . . . . . 23
             5.3.4.  KEK_KEY_LENGTH . . . . . . . . . . . . . . . . . 23
             5.3.5.  KEK_KEY_LIFETIME . . . . . . . . . . . . . . . . 24
             5.3.6.  SIG_HASH_ALGORITHM . . . . . . . . . . . . . . . 24
             5.3.7.  SIG_ALGORITHM. . . . . . . . . . . . . . . . . . 24
             5.3.8.  SIG_KEY_LENGTH . . . . . . . . . . . . . . . . . 25
             5.3.9.  KE_OAKLEY_GROUP. . . . . . . . . . . . . . . . . 25
       5.4.  SA TEK Payload . . . . . . . . . . . . . . . . . . . . . 25
             5.4.1.  PROTO_IPSEC_ESP. . . . . . . . . . . . . . . . . 26
             5.4.2.  Other Security Protocols . . . . . . . . . . . . 28
       5.5.  Key Download Payload . . . . . . . . . . . . . . . . . . 28

[include full document text]