Subject: [HOKEY] Issue 10: Key type

From: Madjid Nakhjiri <[email-masked]>
Date: Fri, 03 Aug 2007 13:15:46 -0700

Responding to Yoshi's comment on key-mgm doc on key types:

I can see Yoshi's point.

I think specifying the key type is cleaner than specifying server type.

Now the question is in which messages is key type used and how is key type
preference/info communicated

1) The third party could here announce what type of key it wants in the
message 0 to the peer, so that the peer could communicate the key type in
message 1 towards the server, I am not sure if this is the best option,
given that the third party could be a domain server or an authenticator or a
HOKEY server, things can get complicated if we want to define a generic
protocol.

Otherwise, the peer does not what type of key the exchange is about, until
end of the exchange.

Alternatives: 

2) the third party can send a key type in message 2 to the server.

3) Server decides based on the policy and the service ID, what key type to
generate.

Finally the server needs to include key type in message 3 both in peer token
and the token to the third party.

Also, the third party announces its device ID to the peer in message 0. I
think it should announce the domain ID too (maybe when there is a USRK
involved, it won't be needed, not sure at this point). 

We can include Server ID, domain ID and key type in message going from third
party to the server.

I prefer option 2, any comments?

Madjid

[4] I think Key Type needs to be carried in the protocol to identify 

> the type of key (i.e., USRK, DSUSRK, DSRK, etc.) to be distributed to 

> the third party.  I think that such a key type is part of information 

> to identity a key.

> Madjid>>Wouldn't you know that based on the type of third party you 

> Madjid>>are

> dealing with? Sounds like the key name discussion.

Then the issue would be how to identify the type of third party or server.

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

---

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Fri, 3 Aug 2007 20:08:33 -0700

I can see Yoshi's point.

Now the question is in which messages is key type used and how is key
type preference/info communicated

1) The third party could here announce what type of key it wants in the
message 0 to the peer, so that the peer could communicate the key type
in message 1 towards the server, I am not sure if this is the best
option, given that the third party could be a domain server or an
authenticator or a HOKEY server, things can get complicated if we want
to define a generic protocol. 

Exactly!  That's why we're not building a protocol that is any more
general than it has to be for our purposes. 

Otherwise, the peer does not what type of key the exchange is about,
until end of the exchange. 

OK, but why does that matter? 

Alternatives: 

3) Server decides based on the policy and the service ID, what key type
to generate.

Finally the server needs to include key type in message 3 both in peer
token  

OK

 Why?  All this "third party" is going to do is use it, right?

Also, the third party announces its device ID  

Please define "third party"? Device ID?  What is that?

to the peer in message 0. I think it should announce the domain ID too
(maybe when there is a USRK involved, it won't be needed, not sure at
this point). 

Please define "domain ID" (& "domain" for that matter ;-) 

We can include Server ID, domain ID and key type in message going from
third party to the server.

Madjid

> dealing with? Sounds like the key name discussion.

Then the issue would be how to identify the type of third party or
server.