Subject: [HOKEY] Review of draft-hoper-hokey-arch-design-02

From: Zhen Cao <[email-masked]>
Date: Sat, 24 Apr 2010 12:11:20 +0800

Dear All,

I'd like to add some comments to the Hokey architecture document as
below. Thanks the authors for the hard work.

1. Section 2
1.1. I prefer the using term "EAP Pre Authentication Service" to "EAP
Early Authentication Service". We already have a PS document on hokey
preauth, so this term is more easily understandable.

1.2. EAP(Early) Re-authentication service.
In my opinion, the difference between the early authentication and
re-authentication is judged by whether the keys are delivered to the
CAP before the attachment (early authentication) or after the
attachment (re-authentication). So the EAP Early Re-authentication is
actually the normal Early Authentication. In the sketch of section6.3,
the procedure is actually the same with what hokey-aak draft is
stating (which is classified into early authentication of 6.1.3 ).

2. Section 3.1.2
"but it requires the peer to know the domain name of the ER server in
order to derive the necessar re-authentication keying material"
I suggest adding "local" in front of the "ER Server" to make it more clear.

3. Section 3.2
What's the "HOKEY server"? I suggest adding a term in section 2 to
stating that HOKEY servers are entities that offering HOKEY
Authentication Services.

4. Section 4.1
Do we need to consider the HOKEY accounting issues? Normally in mobile
networks, the accounting of the visited domain is different from the
home domain.

5. Section 4.3
Still, I am not convinced of the difference between the bullet 1
(early EAP authentication) and bullet 3 (early EAP re-authentication).

6. Other comments:
I remember that last meeting we have discussed the issues regarding
inter AAA server handover. We may consider adding this to the
architecture document, or at least describing why it is in scope or
out of scope.

Thanks and regards,
Zhen

---

From: "Glen Zorn" <[email-masked]>
Date: Mon, 26 Apr 2010 12:02:14 +0700

> preauth, so this term is more easily understandable.

Filename notwithstanding, the actual title of the document in question is
"Extensible Authentication Protocol (EAP) Early Authentication Problem
Statement" so I don't really understand this statement.

...

---

From: Zhen Cao <[email-masked]>
Date: Wed, 28 Apr 2010 09:52:05 +0800

Thanks for the clarification on this comment.