Subject: Re: [HOKEY] EMSK Hierarchy Changes: local EAP server

From: "M. Vanderveen" <[email-masked]>
Date: Thu, 1 Feb 2007 13:16:32 -0800 (PST)

I also believe roaming is perfectly relevant to this group, and I agree that

>  HOKEY solution should not be restricted to
>work with a particular authorization policy only.

but conversely, the HOKEY solution should not restrict/render unworkable this particular authorization policy. I have been trying to point out that there is a danger of the hokey solution to make this type of authorizatio policy (in my view, a much larger issue of AAA separation of domains) non-compliant. This can happen, for example, if we mandate that the local server derive the USRKs directly from the given EMSK-Server-local, rather than through running its own EAP process just like the home domain did. 

On Thu, Feb 01, 2007 at 08:47:59PM +0100, Rafa Marin Lopez wrote:
> Hi Yoshi, Michaela
> 
> sorry for my delayed answer...
> 
> Yoshihiro Ohba escribio':
> > Hi Michaela,
> >
> > On Tue, Jan 30, 2007 at 11:49:15AM -0800, M. Vanderveen wrote:
> >   
> >> The reason to me is as follows: the local domain may have its own authentication/authorization policy that the home domain need not know about, 
> >>     
> >
> > This is already doable.  The visited domain can modify the
> > authorization result came from the home domain to reflect its
> > authorization policy.
> That's is correct, the visited domain can do that. But let suppose the
> local AAA server would prefer to make a re-auth process each t1 seconds
> but the home AAA domain said t2 seconds (t1 < t2). It would imply to
> reach the home AAA server each t1 seconds. The question ... why don't
> the local AAA server could start that re-auth each t1 without involving
> the home AAA server?.
> >   Also, I don't understand how authentication in
> > the local domain can work without the home domain's knowledge about it
> > unless authentication in the local authentication is totally
> > independent of authentication in the home domain (at least there is a
> > dependency in the key hierarchy).
> >   
> Whereas I agree there is a dependence in terms of the key hierarchy, if
> a new EAP method is run between peer and the local EAP/AAA server, it
> implies new fresh values are exchange to create a key hierarchy under
> the key sent to the local AAA server from home AAA domain. Furthermore,
> the home AAA server does not know about that new key hierarchy which
> creates "certain" independence under my point of view.
> >   
> >> and may want to have control over derivation of service keys, as needed. 
> >>     
> >
> > Isn't it just a matter of how we define each USRK usage? 
> Agree.
> >  In any case,
> > without home domain's authorization, the local domain cannot take the
> > control of service key derivations, 
> correct...the home AAA domain needs to give the initial key and related
> authorization parameters associated to that key. But from that point,
> until initial key sent to the local AAA server is about to expire, what
> is happening within the visited domain with the key hierarchy generated
> from that initial key may be only known in the visited domain.
> 
> Does it make any sense to you?.
> 
> My 0.01 cents.
> 
> -- 
> ------------------------------------------------------
> Rafael Marin Lopez
> Depto. Ing. de la Info. y las Comunicaciones
> Faculty of Computer Science-University of Murcia
> 30100 Murcia - Spain
> Telf: +34968398501    e-mail: [email-masked]
> ------------------------------------------------------
> 
>

____________________________________________________________________________________
Don't pick lemons.
See all the new 2007 cars at Yahoo! Autos.
http://autos.yahoo.com/new_cars.html 

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey