IETF-66 MSEC applied to RMT

1
Secure Multicast Applied to Reliable Multicast
Transport

• George Gross
• IdentAware Multicast Security gmgross_at_IdentAware.
  com
• IETF-66, Montreal, Canada
• July 11th 2006

2
Problem Statement

• Several RMT protocols and building blocks are
  approaching final standardization phase
• To date, no comprehensive survey or solution for
  the security problems latent in these protocols
• denial of service attacks are easy
• adversaries along the path could alter data in
  transit and/or masquerade as a group speaker
• no provision for confidentiality

3
RMT over MSEC IPsec
Group Key Management Subsystem
SPD/SAD control
GKM protocol
API
Reliable multicast application
PKI and crypto library
RMT protocol library
DBMS library
UDP
Crypto- token I/O driver
multicast IP security (SPD/SAD)
Operating system
IP-v4 or IP-v6 or link layer
4
Reliable Multicast TLS
Group Key Management Protocol
GKM protocol
API
RMTLS control
Reliable multicast application
API
PKI and crypto library
RMT library
DBMS library
RMTLS security library
UDP
Crypto- token I/O driver
Operating system
IP-v4 or IP-v6 or link layer
5
RMT and MSEC Have Worked In Parallel, Orthogonal
Efforts

• Until now, it was assumed that IPsec protected
  NORM, FLUTE, ALC, LCT
• MSEC has an IPsec standard in progress, yet a
  transport or application layer mechanism may be
  preferred for security that passes the
  grandmother test.
• Expertise needed from both RMT and MSEC areas to
  formulate that alternative