Subject: Re: [HOKEY] EMSK Hierarchy Changes: local EAP server

From: Rafa Marin Lopez <[email-masked]>
Date: Thu, 01 Feb 2007 20:47:59 +0100

Hi Yoshi, Michaela

sorry for my delayed answer...

Yoshihiro Ohba escribio':
> Hi Michaela,
>
> On Tue, Jan 30, 2007 at 11:49:15AM -0800, M. Vanderveen wrote:
>   
>> The reason to me is as follows: the local domain may have its own authentication/authorization policy that the home domain need not know about, 
>>     
>
> This is already doable.  The visited domain can modify the
> authorization result came from the home domain to reflect its
> authorization policy.
That's is correct, the visited domain can do that. But let suppose the
local AAA server would prefer to make a re-auth process each t1 seconds
but the home AAA domain said t2 seconds (t1 < t2). It would imply to
reach the home AAA server each t1 seconds. The question ... why don't
the local AAA server could start that re-auth each t1 without involving
the home AAA server?.
>   Also, I don't understand how authentication in
> the local domain can work without the home domain's knowledge about it
> unless authentication in the local authentication is totally
> independent of authentication in the home domain (at least there is a
> dependency in the key hierarchy).
>   
Whereas I agree there is a dependence in terms of the key hierarchy, if
a new EAP method is run between peer and the local EAP/AAA server, it
implies new fresh values are exchange to create a key hierarchy under
the key sent to the local AAA server from home AAA domain. Furthermore,
the home AAA server does not know about that new key hierarchy which
creates "certain" independence under my point of view.
>   
>> and may want to have control over derivation of service keys, as needed. 
>>     
>
> Isn't it just a matter of how we define each USRK usage? 
Agree.
>  In any case,
> without home domain's authorization, the local domain cannot take the
> control of service key derivations, 
correct...the home AAA domain needs to give the initial key and related
authorization parameters associated to that key. But from that point,
until initial key sent to the local AAA server is about to expire, what
is happening within the visited domain with the key hierarchy generated
from that initial key may be only known in the visited domain.

Does it make any sense to you?.

My 0.01 cents.

-- 
------------------------------------------------------
Rafael Marin Lopez
Depto. Ing. de la Info. y las Comunicaciones
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34968398501    e-mail: [email-masked]
------------------------------------------------------

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 01 Feb 2007 15:22:19 -0500

Rafa and Michaela,

You are actually introducing a new authorization policy of delegating
authentication and authorization from home domain to local domains
into EAP-based AAA.  I don't disagree with such an authorization
policy if it makes sense.  However, this is an orthogonal issue to
handover optimization.  HOKEY solution should not be restricted to
work with a particular authorization policy only.

Although I know that re-auth in local domains is doable by simply
defining a new USRK for that particular usage and define necessary
hierarchy from that USRK, I suggest stop discussing this in HOKEY.

Yoshihiro Ohba

---

From: "Julien Bournelle" <[email-masked]>
Date: Thu, 1 Feb 2007 22:03:44 +0100

Hi Yoshi, all,

> hierarchy from that USRK, I suggest stop discussing this in HOKEY.

 The bullet 6/ of the HOKEY WG charter is:

" 6) A specification for inter-EAP-authenticator roaming and re-
authentication in visited domains that is brokered using inter-domain
trust relationships to support efficient inter-domain roaming."

 This mentions re-authentication in visited domain so I thought that it makes
 sense to discuss this in HOKEY. Am I missing something ?

 Regards,

 Julien

---

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Thu, 1 Feb 2007 14:04:23 -0800

Yoshihiro Ohba <mailto:[email-masked]> allegedly scribbled on

> hierarchy from that USRK, I suggest stop discussing this in HOKEY.  

While we're discussing things to stop discussing in HOKEY, I would like
to stop diuscussing your novel theories & return to the consensus we
reached in San Jose.  I'm sorry if you didn't/don't understand what the
group was talking about, but that's kind of too bad.

>>>> The reason to me is as follows: the local domain may have its own
>>>> authentication/authorization policy that the home domain need not
>>>> know about,
>>>> 
>>> 
>> local AAA server would prefer to make a re-auth process each t1
>> seconds but the home AAA domain said t2 seconds (t1 < t2). It would
>> imply to reach the home AAA server each t1 seconds. The question ...
>> why don't the local AAA server could start that re-auth each t1
>> without involving the home AAA server?.
>>>   Also, I don't understand how authentication in the local domain
>>> can work without the home domain's knowledge about it unless
>>> authentication in the local authentication is totally independent of
>>> authentication in the home domain (at least there is a dependency
>>> in the key hierarchy). 
>>> 
>> Whereas I agree there is a dependence in terms of the key hierarchy,
>> if a new EAP method is run between peer and the local EAP/AAA server,
>> it implies new fresh values are exchange to create a key hierarchy
>> under the key sent to the local AAA server from home AAA domain.
>> Furthermore, the home AAA server does not know about that new key
>> hierarchy which creates "certain" independence under my point of
>> view. 
>>> 
>>> Isn't it just a matter of how we define each USRK usage? Agree.  In
>>> any case, without home domain's authorization, the local domain
>>> cannot take the control of service key derivations,
>> correct...the home AAA domain needs to give the initial key and
>> related authorization parameters associated to that key. But from
>> that 
>> point, until initial key sent to the local AAA server is about to
>> expire, what is happening within the visited domain with the key
>> hierarchy generated from that initial key may be only known in the
>> visited domain. 
>> 
>> Depto. Ing. de la Info. y las Comunicaciones Faculty of Computer
>> Science-University of Murcia 30100 Murcia - Spain

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 2 Feb 2007 00:17:42 -0500

Glen,

This is actually part of consensus discussion, because some folks (not
me!) want to have per-domain root keys without providing sufficient
justification and analysis, and I was argueing with them.  I have no
intent to encourage a new model.

Yoshihiro Ohba