Subject: [HOKEY] Comments on draft-ietf-hokey-preauth-ps-02

From: "Glen Zorn" <[email-masked]>
Date: Thu, 17 Apr 2008 02:26:46 -0700

Editorial:
Section 1 should be Section 8, just before "Acknowledgements"

Lots of grammatical errors.

Technical:
A better exposition upon the trust relationships involved is required, I
think.  For example, it's not clear to me how indirect pre-auth could
work w/o a pre-existing trust relationship between the SA & CA.

Just a couple of general questions about feasibility: Do we actually
expect service providers to provision (let alone advertise) globally
routable IP addresses in all their NASs?  Similarly, is it actually
reasonable to expect all of one service provider's NASs to share trust
relationships with all of another SP's NASs?

_______________________________________________
HOKEY mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hokey

---

From: Yoshihiro Ohba <[email-masked]>
Date: Sun, 20 Apr 2008 01:17:06 -0400

Glen,

Thank you for the review.

> Lots of grammatical errors.

Charles has the same editorial comments and we will address them 
in the next revision.

> work w/o a pre-existing trust relationship between the SA & CA.

Yes, some trust relationship will be required between serving network
and target network for indirect pre-authentication.  We will add text
on the trust relationships.

> relationships with all of another SP's NASs?

For the first point, globally routable IP address may not be needed
for target authenticators in the case of indirect pre-authentication
and intra-domain direct pre-authentication.  We will revise Section
5.1 accordingly.

For the second point, I think that trust relationship among individual
authenticators may not be not needed.  Trust relationship among
neighboring domains may be sufficient.  A TA can perform reverse DNS
lookup to check if the SA has a domain name of a trusted domain.

Best Regards,
Yoshihiro Ohba