Subject: [MSEC] Question Related to PIM-SM

From: "Salekul Islam" <[email-masked]>
Date: Sun, 6 Apr 2003 22:59:18 -0400

Hi,

I need some clarification related to PIM-SM security. In PIM-SM we have link-local messages that are sent to ALL_PIM_ROUTERS. In security section of PIM-SM spec it is receommended that one SA should be used to protect all the link-local messages. In that spec nothing is mentioned about how to protect multicast data. As far my understanding we need another SA among the sender(s) and receiver(s) to protect mulicast data. When a sender sends data to multicast group it will use the later SA and only the receivers will be able to decrypt the data (not the intermediate routers). Intermediate routers will only bypass these data packets. Is my understanding clear? Or I am missing some points?

I asked the same quetion to PIM WG but they have referred me to ask it here. I am expecting someone's response.

Salekul

---

From: Mark Baugher <[email-masked]>
Date: Mon, 07 Apr 2003 09:15:50 -0700

Salekul,

At 10:59 PM 4/6/2003 -0400, Salekul Islam wrote:
>Hi,
>
>I need some clarification related to PIM-SM security. In PIM-SM we have 
>link-local messages that are sent to ALL_PIM_ROUTERS. In security section 
>of PIM-SM spec it is receommended that one SA should be used to protect 
>all the link-local messages. In that spec nothing is mentioned about how 
>to protect multicast data.

By "multicast data" do you mean the user data that are routed through PIM?

>As far my understanding we need another SA among the sender(s) and 
>receiver(s) to protect mulicast data.

Yes, but I would not call this PIM security unless the senders and 
receivers are PIM routers and the data are PIM messages.

>When a sender sends data to multicast group it will use the later SA and 
>only the receivers will be able to decrypt the data (not the intermediate 
>routers). Intermediate routers will only bypass these data packets. Is my 
>understanding clear? Or I am missing some points?

I think so.  The protection of user's multicast data is quite separate from 
the protection of multicast routing messages.  The two have no dependence 
on each other.

>here. I am expecting someone's response.

I hope my comments are relevant.

Mark

>
>Salekul
><?/smaller><?/fontfamily><?fontfamily><?param Arial><?smaller>

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: Thomas Hardjono <[email-masked]>
Date: Tue, 08 Apr 2003 13:30:11 -0400

Hi Salekul,

Let me try have a go at answering your questions.

>to protect multicast data.

That's correct.  The PIM-SM spec is more concerned about router-to-router 
behavior (including their security), as opposed to the data (and its 
security) being forwarded.

>receiver(s) to protect mulicast data. When a sender sends data to 
>multicast group it will use the later SA and only the receivers will be 
>able to decrypt the data (not the intermediate routers). Intermediate 
>routers will only bypass these data packets. Is my understanding clear? Or 
>I am missing some points?

Yes, that is also correct.

Thus, two different instances of the Group SA (GSA) is needed.  One is for 
the "data" plane, where the members are the Receivers (e.g. people), and 
another for the routing plane where the members are the PIM-routers.

><?/smaller><?/fontfamily><?fontfamily><?param Arial><?smaller>

Hope this helps.

cheers,

thomas
------