Subject: Re: [HOKEY] adoption of https://datatracker.ietf.org/doc/draft-wu-hokey-ldn-discovery/ as a WG document

From: Sebastien Decugis <[email-masked]>
Date: Fri, 02 Apr 2010 12:09:35 +0900

I don't fully understand the purpose of this document.

If my understanding is correct, in many deployment scenario, the DHCP
traffic is allowed only once the peer is authenticated (ex: 802.1X). To
authenticate using ERP protocol, the peer needs to know the local domain
name before the re-authentication starts. Therefore, I really don't
understand how carrying the LDN information in DHCP can help.

Can you please explain it to me?

Best regards,
Sebastien.

Le 27/03/2010 11:22, Glen Zorn a écrit :
> During yesterday's session, the consensus of the room was to adopt
> https://datatracker.ietf.org/doc/draft-wu-hokey-ldn-discovery/ as a WG
> document; the purpose of this message is to confirm this with the entire WG.
> Please read the document and express an opinion before 2 Apr.  Thanks!
>
> _______________________________________________
> HOKEY mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hokey
>
>   

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)

---

From: Qin Wu <[email-masked]>
Date: Fri, 02 Apr 2010 12:03:31 +0800

Hi, Sebastinen:
Thank for your feedback. Let me do some clarification in response to your comments.

Regards!
-Qin
----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
To: <[email-masked]>
Sent: Friday, April 02, 2010 11:09 AM
Subject: Re: [HOKEY] adoption ofhttps://datatracker.ietf.org/doc/draft-wu-hokey-ldn-discovery/ as a WG document

If my understanding is correct, in many deployment scenario, the DHCP
traffic is allowed only once the peer is authenticated (ex: 802.1X). 

[Qin]: It is true in the non-handover scenario. But it is not in the handover scenario.
Each time inter-authenticator handover or inter-AAA handover happens,  DHCP 
procedure should always been performed again.

To authenticate using ERP protocol, the peer needs to know the local domain
name before the re-authentication starts. Therefore, I really don't
understand how carrying the LDN information in DHCP can help.

[Qin]: 
The typical scenario is 
i) peer moves from previous authenticator to the new authenticator
ii) the previous authenticator and the new authenticator share the same Local ER server, i.e., local domain name. 
In this scenario, before the peer move to the new authenticator, the implicit bootstapping
is used by local ER server to fetch DSRK from the home domain, unfortuntely, implicit bootrapping can not 
let the peer know the local domain name. In order to help the peer know the local domain before the re-authentication happens between the peer and the local ER server 
in the local domain, DHCP mechanism can be used to fetch local domain from the DHCP server before the peer leaves the previous authenticator. Becos DHCP procedure happen after implicit bootstrapping, but before the peer move to the new authenticator.

Hope this clarifies. Also you can read the previous version of this draft and presentation slides in the IETF 75 for more details.

Best regards,
Sebastien.

---

From: Sebastien Decugis <[email-masked]>
Date: Fri, 02 Apr 2010 13:10:16 +0900

Hi Qin,

Thank you for the clarification. Anyway, I am still confused. Are you
assuming that the new authenticator always belong to the same domain as
the previous authenticator in the case of handover?

Best regards,
Sebastien.

---

From: Qin Wu <[email-masked]>
Date: Fri, 02 Apr 2010 14:06:41 +0800

Hi, Sebastien:
Thank for raising this issue again. I remembered we talk about this before. My understanding is:
When the authenticator changes the local domain in case of handover, it usually means inter-AAA-domain handover happens, in this case,
the peer can just simply fall back to full regular EAP exchange with implicit bootrapping plus DHCP based LDN discovery. With DHCP
based LDN discovery, the peer can easily fetch the new local domain name. 

Regards!
-Qin

---

From: Sebastien Decugis <[email-masked]>
Date: Fri, 02 Apr 2010 15:14:44 +0900

Hi again,

Thank you for the clarification. I understand now.

Best regards,
Sebastien.

---

From: "Glen Zorn" <[email-masked]>
Date: Fri, 9 Apr 2010 15:18:05 +0700

> Please read the document and express an opinion before 2 Apr.  Thanks!

Given that the deadline for comments passed some time ago without any
objections being raised, the draft in question is adopted as a WG document.
Please submit a new version as draft-ietf-hokey-erp-aak.  Thank you!