Multicast IP Security Composite Cryptographic Groups
George Gross, Haitham S. Cruickshank · 2006
The Multicast IP Security extension architecture [Weis] implicitly assumes a basic endpoint population that shares homogeneous cryptographic capabilities and security policies. In practice, large- scale cryptographic groups may contain a heterogeneous endpoint population that can not be accommodated by that basic multicast IPsec architecture. For example, some endpoints may not have been upgraded to handle the successor algorithm for one that is being retired (e.g. SHA1 transition to SHA-ng). Group deployments that span multiple legal jurisdictions may have a different security policy in each jurisdiction (e.g. key strength). This document defines the group IP security architecture capability. A composite cryptographic allows multicast IPsec applications to transparently interact with the single logical that is formed by the union of one or more basic cryptographic groups.