Subject: RE: [HOKEY] revisions to reauth problem statement

From: <[email-masked]>
Date: Wed, 1 Aug 2007 17:03:12 +0300

Hi,

Hope I'm not responding after deadline for subjected text. If not then
here there are few points/suggestions, perhaps you would like to add

Referring to section 5 - Design goals - 

This section very well explains various goals. However in subsection
'lower latency operation' - it can be emphasized in following way - 

Re-authentication process can be reactive or proactive(e.g. pre-auth)
and design goals for these two different approaches should consider low
latency performance objective.   

Referring to section 6 - Security goals - 

1. key derivation function and keying material format
2. Acceptable policies for handover key recovery?

If such points are within the scope of Design goals + security goals
then relevant text can be placed.

Regds
Preeti 

>I've put together some revisions to the reauth problem statement draft:

>http://www.ltsnet.net/ietf/hokey/draft-ietf-hokey-reauth-ps-02a.txt

<It addresses issues #33 and #34.

>Any comments? Anything else that should be added? Once submissions for
IDs reopens, I plan to submit >the updated document, and then go to
WGLC.

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

---

From: Charles Clancy <[email-masked]>
Date: Fri, 24 Aug 2007 01:34:38 +0100

Preeti,

Thanks for your comments.  I don't think we want to get into reactive vs 
proactive and preauth here, because this is specifically the reauth 
problem statement.

With regard to the security goals section, I think your suggestions may 
be a little too specific.  The KDF and key material formatting are 
specified in the "solutions" drafts, not here, and existing security 
goals would require them to be done properly.

I'm not sure what you mean by handover key recovery.  We don't talk 
about key distribution at all in this document.  Can you be more specific?

-- 
t. charles clancy, ph.d.  <>  [email-masked]  <>  eng.umd.edu/~tcc
adjunct professor, electrical engineering, university of maryland

[email-masked] wrote:
>  >_http://www.ltsnet.net/ietf/hokey/draft-ietf-hokey-reauth-ps-02a.txt_
> 
> IDs reopens, I plan to submit >the updated document, and then go to WGLC.
>

---

From: <[email-masked]>
Date: Mon, 27 Aug 2007 11:28:29 +0300

Hi:

Sorry, unable to respond earlier, as I was away.

Thanks for following response- Pl. find my response inline.

Preeti 

>-----Original Message-----
>From: ext Charles Clancy [mailto:[email-masked]] 
>Sent: 24 August, 2007 03:35
>To: Vinayakray-Jani Preetida (Nokia-NRC/Helsinki)
>Cc: [email-masked]
>Subject: Re: [HOKEY] revisions to reauth problem statement
>
>Preeti,
>
>Thanks for your comments.  I don't think we want to get into 
>reactive vs proactive and preauth here, because this is 
>specifically the reauth problem statement.

>With regard to the security goals section, I think your 
>suggestions may be a little too specific.  The KDF and key 
>material formatting are specified in the "solutions" drafts, 
>not here, and existing security goals would require them to be 
>done properly.
>
>I'm not sure what you mean by handover key recovery.  We don't 
>talk about key distribution at all in this document.  Can you 
>be more specific?

(preeti) I have to admit that I've not finished reading
draft-ietf-hokey-key-mgm-00 draft. In my view if such draft targets one
of the objectives of HOKEY, then problem statement draft can provide
some text relevant to key management as problem statement title -
Handover Key management and Re-authetication Problem statement - very
much suggests that. I am not asking here to be very specific. And when
there is a key management relevant to handover then I presume there will
be relevant policies also. And policies for key management deal with
defining key usage, key lifetime, and key recovery procedures and most
of the time depend on the security requirements for the scenario they
are being deployed.

I am asking here to place any specific details about key distribution or
etc. However if you consider that such overview will bring some
relevance to problem statement then some overview in problem statement
will be enough. 

>
>--
>t. charles clancy, ph.d.  <>  [email-masked]  <>  
>eng.umd.edu/~tcc adjunct professor, electrical engineering, 
>university of maryland
>
>
>