Subject: Re: [HOKEY] Is peer-SA-AAA-CA model EAP pre-authentication?

From: Rafa Marin Lopez <[email-masked]>
Date: Mon, 09 Mar 2009 09:05:06 +0100

Hi Tom, sorry for my delayed answer.

I guess an unified term is possible. We would have to think about it. 
However in HOKEY WG, as far as I know, we have an EAP pre-authentication 
problem statement and the plan I see in the charter is:

Done          First draft on EAP Pre-authentication Specification for 
inter-technology and inter-domain handoffs
Mar 2009      Submit EAP Pre-authentication Specification to IESG

So I assumed that is what it should be done : EAP pre-authentication.

Best Regards.

Tom Taylor wrote:
> The point of my question to Rafa was to determine whether we can find 
> a term that encompasses all approaches to the same objective, which is 
> minimization of the component of handover delay caused by 
> authentication and authorization.
>
> Ashutosh Dutta wrote:
>> The term "pro-active key distribution" for this mechanism sounds 
>> reasonable.
>>
>> Thanks
>> Ashutosh
>>
>> Rafa Marin Lopez wrote:
>>>
>>>>
>>>>   We can call it "pro-active key distribution" or "glen" or maybe 
>>>> we can
>>>> call it "kerberos" (provided that no other standards body has hijacked
>>>> the entire English language, that is). Anything but 
>>>> "pre-authentication".
>>>>   
>>> Completely agree. My vote would be for "pro-active key distribution".
>>>>   Dan.
>>>>
>>>>
>>>> _______________________________________________
>>>> HOKEY mailing list
>>>> [email-masked]
>>>> https://www.ietf.org/mailman/listinfo/hokey
>>>>
>>>>   
>>>
>>>
>> _______________________________________________
>> HOKEY mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/hokey
>>
>>
>

-- 
------------------------------------------------------
Rafael Marin Lopez
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34968398501    e-mail: [email-masked]
------------------------------------------------------

---

From: Rafa Marin Lopez <[email-masked]>
Date: Mon, 09 Mar 2009 09:07:37 +0100

Hi Glen, sorry for my delayed answer.
> Just to be clear, my understanding is that Dan's comment refers to the
> schemes already incorporated in the draft as well as the peer->SA->AAA->CA
> scheme being debated, since none but indirect preauth bear even the
> slightest resemblance to 802.11 preauthentication.
>
>   
I cannot speak on behalf of Dan, but sincerely I thought that he was 
referring to peer-SA-AAA-CA model. He can clarify this better than me. 
In any case, my vote is still to call peer-SA-AAA-CA model as 
"pro-active key distribution".

On the other hand, personally, I couldn't see any problem with the 
definition of EAP pre-authentication in the indirect and direct 
pre-authentication usage scenarios defined by the draft following the 
peer-SA-CA-AAA model. As far as I can see, both scenarios (indirect and 
direct) differ in the use of the lower-layer because, basically at EAP 
level and key management they follow the model in RFC 5247 and the 
definition of EAP pre-authentication: peer (EAP peer), one authenticator 
(CA) acting as EAP authenticator which receives the key material and the 
EAP server (AAA).

---

From: "Dan Harkins" <[email-masked]>
Date: Wed, 11 Mar 2009 12:22:26 -0700 (PDT)

Hi Rafa,

  Sorry to all for not responding earlier. I was privately asked by
you and one other person to clarify my statement and apologize for the
tardiness of this response, I've been swamped lately.

  Maybe you can start speaking on my behalf :-) I was referring to
the peer-SA-AAA-CA model. I also don't have any real problems with
the "direct" and "indirect" usage scenarios in the draft (but I have
a problem with the way they are described-- just a bit vaguely-- and
if I can come up with some helpful suggested text to address my problem
I will do so).

  "pro-active key distribution" sounds great to me. Or we could call it
"Handover ANticipated Keying", or HANK for people who have a preference
for cute names. It doesn't matter, I just prefer we not call it
"pre-authentication" because of the popular connotation of that term
which is, to me, different.

  regards,

  Dan.