Subject: [HOKEY] Key naming in HOKEY

From: Lakshminath Dondeti <[email-masked]>
Date: Tue, 05 Feb 2008 23:58:41 -0800

Hi all,

Dan, Charles, Joe and I had a discussion in the afternoon (PT) today.  I 
have a better understanding of Dan's proposal for key naming and it 
appears that all four of us are okay with it.  I would like to hear any 
other thoughts/objections before I incorporate that.  This requires a 
change to the EMSK and the ERP documents.

The idea is as follows:
Name the EMSK.
As long as there is a single mechanism to derive a key and if each key 
is used for a single known purpose, there is no need to independently 
name each key.

In case of ERP, instead of the rIKname, we use the EMSKname.  The NAI 
used will indicate which key, and specifically which rIK is used to 
integrity protect the ERP message.  If the NAI is of a local ER server, 
then it is the corresponding DS-rIK.  If the NAI is the home ER server, 
then it is the rIK.

The advantage here is that we don't need to name every key (no need for 
the SHA256 operations that Dan does not like :) ).  It is still possible 
to unambiguously identify which key is used in any given context.  That 
is possible only if as I state above "there is a single mechanism to 
derive a key and if each key is used for a single known purpose."

Please let me know if this change is acceptable.

regards,
Lakshminath
_______________________________________________
HOKEY mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/hokey