Subject: Re: [HOKEY] ERX-12 -- Please review changes

From: Bernard Aboba <[email-masked]>
Date: Mon, 25 Feb 2008 13:30:12 -0800

> > Sure, it appears from the 802.1X and 4306 that their specifications> > were written with 3748 in mind and that makes sense.> Right.
 
Is this true of all existing EAP lower layers? IEEE 802.16, IEEE 802.1, IEEE 802.11, 
IKEv2, etc.? Are the changes just to accomodate the Initiate/Re-auth message, 
or also for other aspects, such as the Local Domain ID?  
> > Open ended specifications don't always work.> > But we should have gotten this done more right than it appears to have> been done, at least with IKEv2...> > > So if 802 networks or IKEv2 want to use ERX, they need to update their> > specifications. 
 
Assuming that every existing EAP lower layer will change to accomodate ERX
seems somewhat optimistic, no?  Wouldn't it be more likely that solutions will
be adopted which don't require changes to RFC 3748?
 
> > If I were adding ERX to IKEv2 -- I'd send> > EAP-Initiate/Re-auth message in the third message (from Initiator to> > Responder); if the authenticator does not understand ERX, it responds> > with EAP-Request. Since the lower layer is reliable, the> > authenticator always starts with EAP-Request and not> > EAP-Initiate/Re-auth-Start message. I will specify an N payload for> > the authenticator to send domain name information and another to> > indicate ERP support in message 2.> > Right.> > > I would imagine that is quite clear from the specification; if not,> > future designers can look at this archive for information. It is> > contextual to the lower layer and so it is not clear what to write in> > the current specification.> > I think the applicability of ERX in currently popular lower layers is an> important piece of information for the reader. Please document this in> hokey-erx.
I'd agree that dependencies on lower layer changes (and incompatibilities
with existing lower layers) needs to be documented. 

_______________________________________________
HOKEY mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hokey

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 25 Feb 2008 15:24:50 -0800

Comments below. 

> Date: Mon, 25 Feb 2008 14:15:47 -0800
> From: [email-masked]
> To: [email-masked]
> CC: [email-masked]; [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [HOKEY] ERX-12 -- Please review changes
> 
> On 2/25/2008 1:30 PM, Bernard Aboba wrote:
> >  > > Sure, it appears from the 802.1X and 4306 that their specifications
> >  > > were written with 3748 in mind and that makes sense.
> >  > Right.
> >  
> The changes are primarily to accommodate the peer initiated aspect; the 
> new code; and less so about communicating support for ERP (optional 
> really) and to send local domain id (there are other ways for the peer 
> to get this information, e.g., ERP bootstrapping).

[BA] OK.  Might be useful to make this clear (e.g. that local domain id
support is optional). 

> 
> When I wrote about how to add support for ERX in IKEv2 -- I have never 
> thought about that before -- I found it to be surprisingly easy.  I am 
> planning now to write a draft or simply ask text to be included in 
> ikev2bis.  Does that sound like a good idea?

[BA] I'd talk to Pasi and Paul Hoffman about this. 

> 
> > 
> >  > > Open ended specifications don't always work.
> >  >
> >  > But we should have gotten this done more right than it appears to have
> >  > been done, at least with IKEv2...
> >  >
> >  > > So if 802 networks or IKEv2 want to use ERX, they need to update their
> >  > > specifications.
> >  
> It turns out some changes to lower layer are in fact necessary to 
> accommodate efficient reauthentication.  The exception, if we have a 
> bigger delay budget, is method-based reauthentication, but that does 
> imply doing it for every method; operation with the home server and 
> multiple roundtrips.
>
> So, whereas it would be great if we could do it without changes to 3748 
> and lower layers, I don't think that is possible.  We could do it with 
> substantial changes to each lower layer, including a key hierarchy 
> specification, for instance as in case of 11r.  But that implies 
> substantial changes to all lower layers.
>

[BA] I've recently seen a draft (from Yoshi, submitted today) that  seems

to provide similar functionality with no changes to RFC 3748.  Although

I haven't reviewed the document in depth, it did seem to provide

method-independent re-authentication without multiple round-trips

(at least for case of a local ERX server, which is the most important

one from a performance point of view).  

This document will probably be discussed in IEEE 802, which could adopt
it as their approach to EAP re-authentication going forward. 

If possible, it would be good to have a single standard for this, as opposed
to multiple competing ones. 
_______________________________________________
HOKEY mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hokey