Subject: [HOKEY] I-D Action:draft-ietf-hokey-emsk-hierarchy-05.txt

From: [email-masked]
Date: Wed, 23 Apr 2008 08:15:02 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Handover Keying Working Group of the IETF.

	Title           : Specification for the Derivation of Root Keys from an Extended Master Session Key (EMSK)
	Author(s)       : J. Salowey, et al.
	Filename        : draft-ietf-hokey-emsk-hierarchy-05.txt
	Pages           : 19
	Date            : 2008-04-23

The Extensible Authentication Protocol (EAP) defined the Extended
Master Session Key (EMSK) generation, but reserved it for unspecified
future uses.  This memo reserves the EMSK for the sole purpose of
deriving root keys.  Root keys are are master keys that can be used
for multiple purposes, identified by usage definitions.  This
document also specifies a mechanism for avoiding conflicts between
root keys by deriving them in a manner that guarantee cryptographic
separation.  Finally, this document also defines one such root key
usage: domain specific root keys are root keys made available to and
used within specific key management domains.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-hokey-emsk-hierarchy-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
HOKEY mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hokey

---

From: "Dan Harkins" <[email-masked]>
Date: Wed, 23 Apr 2008 10:49:50 -0700 (PDT)

Hi,

  There's no "changes from -04" section of the -05 draft so what
changed? And why? Is this in response to some comments in IETF LC?
If so, which ones? And what about the other comments in IETF LC
received on -04 that were not addressed in -05? What's the procedure
on addressing them? Is there going to be an -06?

  A note to the chairmen: what happens to comments on -04 that weren't
addressed in -05? Should they be made _again_ (and again and again) on
on -05 or do they "carry over"?

  Inquiring minds want to know....

  Dan.

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 24 Apr 2008 01:05:29 -0700

Dan Harkins <> scribbled on :

>  Hi,
> 
>  There's no "changes from -04" section of the -05 draft so
> what changed? And why? Is this in response to some comments in IETF
> LC? If so, which ones? And what about the other comments in IETF
> LC received on -04 that were not addressed in -05? What's the
> procedure on addressing them? Is there going to be an -06?

Since the state of the document is "Waiting for AD Go-Ahead", hopefully
not.

> 
>  A note to the chairmen: what happens to comments on -04 that
> weren't addressed in -05? Should they be made _again_ (and
> again and again) on on -05 or do they "carry over"?

There are a couple of ways that comments can be addressed: 

1) the document may be changed in response to the comment(s)
2) the comment(s) may be temporarily set aside pending further
discussion on the list
3) the comment(s) may be rejected

In the case of #2 the comments will eventually be considered & end up in
either bin #1 or bin # 2.  Comments may be rejected for several reasons
including (but not limited to) irrelevance and contradiction of WG
consensus; just because a given comment didn't result in the document in
question being changed doesn't mean that it wasn't addressed.  At this
point in the lifecycle of a draft, the "AD is responsible for verifying
that all Last Call comments have been adequately addressed" (see
https://datatracker.ietf.org/idtracker/help/state/19/).  In this case
the AD referenced would be Tim Polk (copied).  

>  Inquiring minds want to know....

Are there some particular comments you have in mind or is it just a
matter of curiosity about procedures?  If the former, please discuss the
matter w/Tim (copying, if you don't mind,
mailto:[email-masked] or the WG). 

>  Dan.

...

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 24 Apr 2008 09:07:13 -0700 (PDT)

It is most definitely not merely curiosity about procedure.
Specifically, it's about issue #45. You've been copied on emails to
the people you list below.

  Where is the issue list anyway? One would naively assume that it
would be the "issues" link off http://tools.ietf.org/wg/hokey/ but
there is nothing there.

  I understand comments can be rejected. Does one just infers that
a comment has been rejected because all of a sudden the draft's status
changes? Not knowing where the issue list resides one could also infer
that an issue was "lost". I raised an issue in WGLC and heard nothing
about resolution of it and then all of a sudden I notice the draft is
in IETF LC. Was the issue rejected? Was it lost? Dunno. Am I supposed to
just wait for an announcement of publication from the RFC editor to find
out about #45? That doesn't sound right.

  If the process is intentionally opaque then that would be nice to
know. Just tell me and I'll just go away and grumble to myself.

  Dan.

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 24 Apr 2008 09:38:31 -0700

Dan Harkins <mailto:[email-masked]> scribbled on Thursday, April
24, 2008 11:07 PM:

...

>  Where is the issue list anyway? One would naively assume
> that it would be the "issues" link off
> http://tools.ietf.org/wg/hokey/ but there is nothing there.

A while back ietf.org's list of working group charter pages got messed
up & we lost the link from the site.  It's at
http://www.ltsnet.net:8080/hokey/

> 
>  I understand comments can be rejected. Does one just infers
> that a comment has been rejected because all of a sudden the
> draft's status changes? Not knowing where the issue list
> resides one could also infer that an issue was "lost". I
> raised an issue in WGLC and heard nothing about resolution of
> it and then all of a sudden I notice the draft is in IETF LC.

I could have sworn that Charles had told you that there was, in his
opinion (which I share, BTW), long-standing WG consensus on the
structure of the key hierarchy.  Am I mistaken?

> Was the issue rejected? Was it lost? Dunno. Am I supposed to
> just wait for an announcement of publication from the RFC
> editor to find out about #45? That doesn't sound right.

As I mentioned in my last message, the person to talk to about this is
the AD.

> 
>  If the process is intentionally opaque then that would be
> nice to know. Just tell me and I'll just go away and grumble to
> myself. 

What would you consider to be a transparent outcome?

...

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 24 Apr 2008 11:11:51 -0700 (PDT)

> http://www.ltsnet.net:8080/hokey/

  Excellent. Thanks.

> structure of the key hierarchy.  Am I mistaken?

  He told me that when he, in his word reluctantly, created the issue.
And since both of you have decreed there is consensus then I guess
that settles it.

  But it is still quite hard to believe. Quite a few people thought the
DSRK was so you didn't have to do a full EAP exchange back to your home
AAA server when you visited a new "domain". To quote, just as one example,
Madjid: "The D in DSRK was marketed to mean administrative domain. It was
claimed to handle the roaming scenarios." Then the DSRK sort of morphed.
It was agreed that we would always do a full EAP exchange back to the home
AAA server when you visited a new "domain". Is this claimed consensus
on the bait or on the switch?

  So we got a DSRK but with no clear definition of what it was for so
then there was a huge discussion about a "key management domain" was. Not
about the utility or need for a DSRK, just about what a "key management
domain" was. Is that the claimed consensus? On what a "key management
domain" is?

  What is a DSRK? It is a root key "that is restricted to use in a specific
key management domain." And what is a key management domain? "A key
management domain is specified by the scope of a given root key."
Wonderfully circular.

  And when one brings up the issue of getting rid of the DSRK there is
restatement of the key hierarchy, baseless appeals to the charter, and
the standing up and knocking down of straw men.

  Here's a snippet from an email from Alan DeKok on Feb 3rd:
<start of snippet>

Lakshminath Dondeti wrote:
> On 2/2/2008 6:22 PM, Dan Harkins wrote:
>>   It was my understanding that we had consensus around the idea that
>> each time a peer went to a new domain he would do a full authentication
>> back to the home AAA server.
>
> I had the opposite understanding.  After it was pointed out that the key
> hierarchy was not complex at all and the dispute was about 1 level vs. 2
> levels, the discussion died down.

  I agree with Dan.  I had commented on this issue, too, and I did not
see any counter-argument.  It has nothing to do with a key hierarchy, so
I'm not sure why you brought that up.

<end of snippet>

  Right. No counter-argument. In fact, no real discussion on what a DSRK
is for or why it's needed. But somehow we have consensus on it. Very
curious.

> What would you consider to be a transparent outcome?

  Some way to find out the resolution of an issue. An issue is raised
during LC and the the document advances. What happened to the issue? Was
it just ignored?

  I don't count straw man arguments or mere restatement that the key
hierarchy exists as demonstration of consensus in the WG or that the
issue I raised on the DSRK was rejected. The thread just died mostly
because it became somewhat pointless to raise the issue and get told about
the key hierarchy again. And then the draft is in IETF LC! So from my
viewpoint the issue was not resolved.

  If the chairmen believe an issue was officially rejected then how about
mentioning that on the list prior to shepherding the document into IETF
LC? And, while it is not strictly necessary, a smidge of justification for
the belief that consensus exists might be nice to mention too.

  I guess I would like ignoring a comment and rejecting a comment to be
discernible to the WG.

  regards,

  Dan.

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 24 Apr 2008 11:40:32 -0700

Dan Harkins <mailto:[email-masked]> scribbled on Friday, April 25,
2008 1:12 AM:

...

>  Some way to find out the resolution of an issue. An issue is
> raised during LC and the the document advances. What happened
> to the issue? Was it just ignored?

OK, just one more time: at this stage of the lifecycle of a draft, the
AD is responsible for ensuring that all LS issues have been resolved.
Is that somehow not clear?  If you actually want to find out the
resolution of the issue, ask the AD.

...

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 24 Apr 2008 12:25:15 -0700 (PDT)

Glen,

> resolution of the issue, ask the AD.

  Surely it must be obvious to you that the issue was only brought up
because it was not resolved during WGLC. That is why if you read the
post in its entirety (or at least just a bit down from where you stopped
quoting) you'll notice that I raised the issue and then without any
mention of its resolution the draft advanced to _IETF LC_. One should be
able to infer that the text above was referring to an earlier stage of the
lifecycle of the draft. Yes, now it is in IETF LC. I sent an email to the
AD yesterday actually.

  I don't think it's unreasonable to ask for a process that allows the
WG to discern between ignoring a comment and rejecting a comment.

  Dan.