Subject: [HOKEY] draft-ietf-hokey-erx-04 - Revision and Fixes to Issues from Tracker

From: "Narayanan, Vidya" <[email-masked]>
Date: Fri, 24 Aug 2007 18:26:04 -0700

All,
The updated draft can be found at
http://www.ietf.org/internet-drafts/draft-ietf-hokey-erx-04.txt.  The
authors believe that this revision captures all the issues that need to
be addressed based on the issues tracker (status detailed below) and
that the document is ready for WGLC.  Assuming the chairs believe that
the issues have been resolved satisfactorily, we request them to issue a
last call on the document. 

Thanks,
Vidya

Here is a status on the issues from the issues tracker: 

------------------------

Issue 4: ERX: channel binding support needed  

Resolved in the earlier version

------------------------

Issue 5: ERX: initial HOKEY message            

Resolved - added EAP Initiate Re-auth-Start message for authenticator
initiation

------------------------

Issue 17: ERX: ERX in the title                     

Resolved - changed title to "EAP Extensions for EAP Re-authentication
Protocol (ERP)" to include ERP in the title

------------------------

Issue 16: ERX: terminology issues                  

There was no consensus on changing the terms. Hence, no changes have
been done in this revision. 

------------------------

Issue 15: ERX: bootstrapping possibly broken   

No technical issues with ERP bootstrapping were noted.  We are not
suggesting any changes to the EAP behavior or use of the MSK produced by
EAP - hence, any restrictions/changes to the use of the MSK is
inappropriate for this document.  Hence, no changes are needed here. 

------------------------

Issue 19: ERX: location of integrity key          

The use of rIK for the ERP exchange itself is appropriate, since it uses
an integrity key that is produced for the context of re-authentication.
If the re-authentication functions were performed by an entity other
than the EAP server (EMSK holder), this produces no dependencies on any
key outside the re-authentication key hierarchy.  Hence, no changes are
needed here. 

------------------------

Issue 20: ERX: preauth text                        

Resolved

------------------------

Issue 18: ERX: editorial changes                   

Resolved

------------------------

Issue 21: ERX: rMSK derivation id/seq          

Cryptographically, the necessary separation across rMSKs is provided by
the sequence number.  The EAP methods do not use any authenticator IDs
in the MSK generation as well.  So, there is no need to include
identities in the rMSK generation either.  Channel binding support is
provided in ERP and that can be used to assert identities when needed.
The lower layer may choose to include the appropriate identities in the
TSK generation (as some lower layers already do). 

------------------------

Issue 22: ERX: key transport and refs to key mgt doc 

Open issue; not sure what the reference would be needed for. 

------------------------

Issue 23: ERX: root key -- USRK or DSUSRK?    

Subsequent consensus is not to derive DSUSRKs from USRKs.  Hence, this
issue is no longer valid. 

------------------------

Issue 32: ERX: transport protocol                 

Subsequent to the discussion at IETF69, this no longer seems to be an
issue. 

------------------------

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey