SKIP Source Release is out!

Hi,

Check out http://skip.incog.com.  We've released the source to the SKIP
key management and IP layer encryption package for SunOs 4.x.

Here's a piece of the README file:


	ALPHA 1 Release of SKIP Reference Source for SunOS 4.1.3
	--------------------------------------------------------

SKIP is a Key-management protocol for IP based protocols.  It is an 
acronym for Simple Key-management for Internet Protocols. SKIP is 
documented in the SKIP IETF IPSEC draft included in this directory 
as draft-ietf-ipsec-skip-05.txt.  The most recent SKIP draft is 
always available at http://skip.incog.com and the Internet-Drafts
directories.

>From this public domain source release, you can build a fully 
functional IP-layer encryption package which supports DES and 
Triple-DES for SunOS 4.1.3.  This means that every IP networked 
application can have it's network traffic encrypted.   Unlike
application level encryption packages, this package encrypts 
IP packets.  Thus, applications do not need to be recompiled or 
modified to take advantage of encryption.

The SKIP source is possible through the efforts of engineers in Sun
Microsystems Internet Commerce Group.  The developers and designers
are Ashar Aziz, Tom Markson, Martin Patterson, Hemma Prafullchandra and
Joseph Reveane.  Linda Cavanaugh worked on the documentation.

The package compiles under both the SunPro compiler and GCC.  We expect 
that this release should port without too much pain to any operating 
system which uses BSD style networking (mbufs).  

A legal warning: Because this package contains strong encryption, the
Software must not be transferred to persons who are not US citizens or
permanent residents of the US, or exported outside the US (except
Canada) in any form (including by electronic transmission) without
prior written approval from the US Government. Non-compliance with
these restrictions constitutes a violation of the U.S. Export Control
Laws.

This source release may be used for both commercial and noncommercial 
purposes, subject to the restrictions described in the software and
patent license statements.  

Furthermore, Sun Microsystems has licensed the Stanford public key patents 
from Cylink Corp. which are available to users of this package on a royalty 
free basis. The patent statement is in README.PATENT.  Be sure to read this,
as it contains some restrictions and other important information.  

Also included in this release is a high speed Big Number package written 
by Colin Plumb. bnlib/legal.c contains Colin's software license statement. 

Features
--------
	1.  SKIP V2 compliant implementation using ESP encapsulation.
	2.  Support for DES/3DES for traffic and key encryption.
	3.  Diffie-Hellman Public Key Agreement based system.
	4.  Full Support for manual establishment of master keys.
	5.  Support for multiple NSIDs and multiple local certificates.
	6.  GUI tool for user friendly manipulation of access control lists
	    and key statistics.
	7.  Command line tools for manipulating access control lists, etc.
	8.  Implementation of the Certificate Discovery protocol fully
	    integrated into SKIP.
	9   Implementation of X.509 public key certificates.
	10. Implementation of DSA signature algorithm for certificate
	    signatures.
	11. Implementation for MD2, MD5 and SHA message digest algorithms.
	12. Implementation of ASN.1 DER encoding/decoding.
	13. SunScreen(tm) SKIP compatibility mode.
	14. Implementation of hashed public keys as defined in the SKIP 
	    draft.  Implementation of programs to generate hashed public
	    keys.
	15. Certificate utilities to convert X.509 Certificates to hashed
	    keys and  print both X.509 and Hashed certificates.
	16. High performance Big Number library for Diffie-Hellman 
	    calculations.
	17. Implementation is effectively "public domain" and may be used both 
	    commercially and non-commercially.
	18. Patent Agreement with Cylink allows roylaty-free use of the 
            Diffie-Hellman and other Stanford patents with this package for 
	    commercial and non-commercial use.  Read README.PATENT for 
	    some restrictions.
	19. Inclusion of prime generation program used to generate the 
	    primes in SKIP draft.

Tom Markson writes:
> Check out http://skip.incog.com.  We've released the source to the SKIP
> key management and IP layer encryption package for SunOs 4.x.

SKIP is a non-standard being pushed by Sun.

Admittedly, it is available for FTP. However, thats just because I
don't have an FTP site for the NRL IPsec + IPv6 stuff.

Anyone who'd like to help me put the sources to the NRL IPsec + IPv6
implementation up for FTP is invited to get in touch. It will runs on
4.4BSD machines (i.e. BSDI, NetBSD, FreeBSD, etc) and should be
pretty portable to other similar Berkeley based machines.

It won't "run out of the box" on NetBSD as it stands -- I should have
it nicely packaged up to do that before the end of the week.


Perry

Perry sez:

>
>Tom Markson writes:
>> Check out http://skip.incog.com.  We've released the source to the SKIP
>> key management and IP layer encryption package for SunOs 4.x.
>
>SKIP is a non-standard being pushed by Sun.
>

Correct me if I'm wrong, but isn't sun trying to make it a standard
(in competetion with Photuris) ?

Can I also assume that the IPV6 stuff requires pretty extensive kernel
mods? (Not bad, but a very definite consideration)

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress

Doug Hughes writes:
> >Tom Markson writes:
> >> Check out http://skip.incog.com.  We've released the source to the SKIP
> >> key management and IP layer encryption package for SunOs 4.x.
> >
> >SKIP is a non-standard being pushed by Sun.
> 
> Correct me if I'm wrong, but isn't sun trying to make it a standard
> (in competetion with Photuris) ?

The IETF has many sorts of standards. It explicitly has a way to
standardize things that the IETF doesn't think are a good idea but
which should have the ability to interoperate if you do them.

My opinion is that it is fairly clear that Photuris is the key
management system people will be using, although it is going to have
to evolve to work with a real network wide certificate database
infrastructure. SKIP isn't going to be the standard.

> Can I also assume that the IPV6 stuff requires pretty extensive kernel
> mods? (Not bad, but a very definite consideration)

IPSEC, SKIP, IPv6, etc., all require kernel mods. You can't help
it. Its part of the IP stack, you know.

BTW, IPv6 uses IPSEC, but IPSEC isn't only for IPv6 -- its also usable
in IPv4. We were careful about how we architected that.

The NRL code implements IPsec for both v4 and for the v6 stack it
comes with. In fact, the NRL code is primarily an IPv6 implementation
-- they just implemented IPSEC as a side effect.

Perry

>
>Doug Hughes writes:
>> >Tom Markson writes:
>> >> Check out http://skip.incog.com.  We've released the source to the SKIP
>> >> key management and IP layer encryption package for SunOs 4.x.
>> >
>> >SKIP is a non-standard being pushed by Sun.
>> 
>> Correct me if I'm wrong, but isn't sun trying to make it a standard
>> (in competetion with Photuris) ?
>
>The IETF has many sorts of standards. It explicitly has a way to
>standardize things that the IETF doesn't think are a good idea but
>which should have the ability to interoperate if you do them.
>
>My opinion is that it is fairly clear that Photuris is the key
>management system people will be using, although it is going to have
>to evolve to work with a real network wide certificate database
>infrastructure. SKIP isn't going to be the standard.
>
>> Can I also assume that the IPV6 stuff requires pretty extensive kernel
>> mods? (Not bad, but a very definite consideration)
>
>IPSEC, SKIP, IPv6, etc., all require kernel mods. You can't help
>it. Its part of the IP stack, you know.
>
I knew it was a safe assumption. :)

>BTW, IPv6 uses IPSEC, but IPSEC isn't only for IPv6 -- its also usable
>in IPv4. We were careful about how we architected that.
>
>The NRL code implements IPsec for both v4 and for the v6 stack it
>comes with. In fact, the NRL code is primarily an IPv6 implementation
>-- they just implemented IPSEC as a side effect.
>

'Tis a shame, because SKIP is available right now and will, if past history
is any indication, become the defacto standard on Sun platforms because it
is readily available, and the IPV6 stuff isn't, nor probably will be soon
because even those with the source code are not permitted to give out mods
to this source (in the case of SunOS - I believe). However, a loadable
kernel module would be very nice with the IPv6 stuff in it. Unfortunately,
I have very little experience with loadable kernel modules of this scope,
nor the source code to use as a reference, should the loadable modules be
feasible.


--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress

Doug Hughes writes:
> 'Tis a shame, because SKIP is available right now and will, if past history
> is any indication, become the defacto standard on Sun platforms because it
> is readily available,

I suspect that no one else will use it. Morningstar is already
shipping the ESP/AH stuff -- other router vendors are doubtless going
to be doing so soon as well. All other hardware manufacturers will be
running the normal IPSEC too. I suspect Sun is going to have a very
tough sell.

Perry