MIKEY Capability Discovery Seokung Yoon (Korea Information Security Agency) draft-seokung-msec-mikey-capability-discovery-00.txt

Problem Statement We implemented a secure VoIP phone with SRTP (AES, SEED) and MIKEY for a key management protocol for SRTP To set up a secure call, the capability discovery procedure should be needed and defined in MIKEY But, capability discovery define in MIKEY needs two roundtrip if the initiator select mismatch algorithm with the responder It is not appropriate for the real-time communication

Capability Discovery in MIKEY Initiator Responder AESSEED SEED INVITE (MIKEY Init) = {AES} Error = {SEED} NEW INVITE (MIKEY Init) = {SEED} 200 OK (MIKEY Resp) Secure Media Session (SRTP) The initiator indicates the security policy to be used. If the responder does The initiator indicates the security policy to be used. If the responder does not support it, the responder can together with an error message, send back not support it, the responder can together with an error message, send back its own capabilities to let the Initiator choose a common set of parameters. its own capabilities to let the Initiator choose a common set of parameters.

Proposal (1/2) Initiator Responder 200 OK (MIKEY Resp) = {SEED} AESSEED SEED INVITE (MIKEY Init) = {AES, SEED} Secure Media Session (SRTP) The Initiator sends its own capabilities to let the Responder choose a The Initiator sends its own capabilities to let the Responder choose a common set of parameters. This is done by including one or more security common set of parameters. This is done by including one or more security policy payloads policy payloads

Proposal (2/2) Modify the MIKEY Message Modify the MIKEY Message

Next Step Questions or Comments?? Take this work as an WG item??