SKEX Symmetric Key Establishment and Exchange
bofreq-aelmans-skex-symmetric-key-establishment-and-exchange-06

Document Type Approved BOF request
Title SKEX Symmetric Key Establishment and Exchange
Last updated 2025-02-06
State Approved
Editor Melchior Aelmans
Responsible leadership Paul Wouters
Send notices to (None)
bofreq-aelmans-skex-symmetric-key-establishment-and-exchange-06

Name: Symmetric Key Establishment and Exchange (SKEX)

Description

Symmetric key establishment systems can be used to semi-statically and dynamically provide or supplement keys for existing protocols that accept pre-shared or pre-positioned keys independent of a public key and so might create hybrid keys. For example TLS 1.3 (RFC 8446 and RFC 8773), IPsec (RFC 8784) and MACsec (draft-hb-intarea-eap-mka-00). There are multiple use cases where pre-shared keys using ad hoc key exchange mechanisms are in widespread use despite lacking a general framework. Any scalable key establishment system must address challenges of enrolment, security properties, usability, and cost.

Asymmetric-key cryptography, while powerful and often convenient, has limitations, including being computationally intensive and potentially vulnerable to quantum computing or mathematical attacks, thus not fully addressing all security needs. This emphasises the need for symmetric-cryptography-based key establishment mechanisms that don't rely on asymmetric algorithms. Such systems can provide keys for secure internet communications.

Proposed solutions must address not only the secure transport of symmetric keys but also the mechanisms needed to ensure that only authenticated and authorised peers can securely access these keys. Identifying the peers is part of the enrolment process.

A community of implementers of symmetric key establishment and exchange solutions, network equipment vendors and consumers propose a framework, one or multiple protocols to securely establish symmetric keys between parties, as well as rationalising the formats and interfaces for integration of such key establishment systems into security applications.

Modification of existing protocols, including IPsec, MACsec, TLS, etc., is expected to be out of scope for this WG.

The proponents' goal is to create a framework for secure establishment of symmetric keys to match security requirements, and to streamline their integration into applications. The second objective is to propose one or multiple protocols for symmetric key establishment.

Required Details

Information for IAB/IESG

Agenda

  • Agenda Bashing

    • Timing: 5 min

  • Symmetric Key Establishment solutions: an outline of the need (why are we here?)

    • Timing: 10 min

  • Asymmetric key exchange mechanisms: the problems that they do not address

    • Timing: 10 min

  • Framework for Symmetric Key Establishment solution: requirements and security

    • Timing: 10 min

  • Protocols for Symmetric Key Establishment

    • Timing: 15 min

  • Interactions and interfaces with IPsec, TLS, MACsec, etc.

    • Timing: 15 min

  • Discussion of the proposed Charter

    • Timing: 20 min

  • Discussion

    • Timing: 20 min