Subject: [HOKEY] Handover keying?

From: "Glen Zorn" <[email-masked]>
Date: Wed, 17 Oct 2007 00:10:55 -0600

The following appears in the problem statement i-D: "Lastly, a
re-authentication protocol should also be capable of supporting handover
keying.  Handover keying allows re-authentication keys to be passed to a
different domain."  I'm really confused by this statement.  I had thought
that we agreed a long time ago (like at the SJ interim) that if a device
moved to a new administrative domain (i.e., from Rogers to HKT) a full a EAP
authentication would be required.  If this changed, why?  I'm certainly not
aware of any demand for the kind of functionality suggested by the above
paragraph from any SPs.

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 18 Oct 2007 09:57:26 -0400

> aware of any demand for the kind of functionality suggested by the above

I agree that a full EAP authentication would be required for
inter-domain handover. This means that inter-domain handover is not
optimized by HOKEY re-authentication (and that is why
pre-authentication is important for inter-domain handover).  However,
once inter-domain handover is completed, then intra-domain handovers
within the visited domain can benefit from HOKEY re-authentication.

The paragraph needs to be fixed accordingly.

Yoshihiro Ohba

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 18 Oct 2007 09:13:07 -0700

I think there may be some confusion around the definition of "domain".
>From what I understood of the outcome of the Hokey interim a domain does
not necessarily correspond to a AAA realm or administrative domain.
There may be multiple Hokey domains within an administrative domain or
AAA realm.  

I was not at the interim, so this is hearsay and may be incorrect.
However, if this is not the case and a hokey domain is equivalent to an
administrative domain I don't understand why we need to derive DSRKs,
since we will be doing a complete reauthentication in these cases.

Cheers,

Joe

> -----Original Message-----
> From: Glen Zorn [mailto:[email-masked]] 
> Sent: Tuesday, October 16, 2007 11:11 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [HOKEY] Handover keying?
> 
> The following appears in the problem statement i-D: "Lastly, 
> a re-authentication protocol should also be capable of 
> supporting handover keying.  Handover keying allows 
> re-authentication keys to be passed to a different domain."  
> I'm really confused by this statement.  I had thought that we 
> agreed a long time ago (like at the SJ interim) that if a 
> device moved to a new administrative domain (i.e., from 
> Rogers to HKT) a full a EAP authentication would be required. 
>  If this changed, why?  I'm certainly not aware of any demand 
> for the kind of functionality suggested by the above 
> paragraph from any SPs.
> 
>  
> 
>

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 18 Oct 2007 09:38:37 -0700

Yeah, there would be a new DSRK and that was the intention in my opinion.

regards,
Lakshminath

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Thu, 18 Oct 2007 10:56:06 -0700

Yes, domain corresponds to a key management domain (within which a DSRK
may be valid) and not a AAA realm per se.  They could be aligned, but,
there is no requirement there - essentially, a large administrative
domain may be broken up into several smaller key management domains for
sake of optimizing the reauthentication times upon handoffs. 

That said, there is also no requirement to do a full EAP upon changing
domains.  The reauthentication exchange can occur with the home domain,
resulting in a new DSRK to the new domain - e.g., doing ERP
bootstrapping with the home domain will result in this.  Hence, while
there is a trip to the home domain upon changing key management domains,
there is no need for a full EAP exchange, unless the EMSK has expired. 

If this is not clear, we should be doing a better job of describing what
a domain is in the PS draft. 

Vidya 

> From: Lakshminath Dondeti [mailto:[email-masked]] 
> Sent: Thursday, October 18, 2007 9:39 AM
> To: Joseph Salowey (jsalowey)
> Cc: [email-masked]; [email-masked]
> Subject: Re: [HOKEY] Handover keying?
> 
> > However, if this is not the case and a hokey domain is 
> equivalent to 
> > an administrative domain I don't understand why we need to derive 
> > DSRKs, since we will be doing a complete reauthentication 
> in these cases.
> > 
> > Cheers,
> > 
> > Joe
> > 
> >> re-authentication protocol should also be capable of supporting 
> >> handover keying.  Handover keying allows re-authentication 
> keys to be 
> >> passed to a different domain."
> >> I'm really confused by this statement.  I had thought that 
> we agreed 
> >> a long time ago (like at the SJ interim) that if a device 
> moved to a 
> >> new administrative domain (i.e., from Rogers to HKT) a full a EAP 
> >> authentication would be required.
> >>  If this changed, why?  I'm certainly not aware of any 
> demand for the 
> >> kind of functionality suggested by the above paragraph 
> from any SPs.
> >>
> >>  
> >>
> >>
> >

---

From: "Dan Harkins" <[email-masked]>
Date: Tue, 23 Oct 2007 15:17:01 -0700 (PDT)

I think it's easier for everyone involved as well as everyone that
will become involved in the future if we don't overload commonly-used
terms.

  Dan.