Subject: [HOKEY] Some comments to the draft-ietf-hokey-erp-aak-02

From: young <[email-masked]>
Date: Mon, 21 Jun 2010 17:27:48 +0800

Hi, All：

I have some comments to the draft-ietf-hokey-erp-aak-02

1） Line 180: It is assumed that the peer has previously completed full EAP
   authentication
 The suggested text：
  It is assumed that the peer has previously completed full EAP
   authentication and CAP(s) have been discovered.
2) Line 240：The NAS-Identifier is used to identify the CAP(s)
Question：How the peer get the CAP(s)' NAS-Identifier?
3) Line 253: After the CAP(s) is authenticated and authorized successfully, 
   the ERP/AAK server derives the pRK and the subsequent pMSK for each CAP.
   The ERP/AAK server transports the pMSK to the authenticated and
   authorized CAP(s) via AAA as described in Section 7.
The suggested text：
Suggest to move the " the authenticated and authorized CAP(s)" from the
second paragraph to first paragraph. 
So The suggested text：
   After the CAP(s) is authenticated and authorized successfully, the
ERP/AAK server derives the pRK and the subsequent pMSK to each authenticated
and
authorized CAP.
   The ERP/AAK server transports the pMSK to the CAP(s) via AAA as described
in Section 7.
4) After the keying materials are delivered, the ERP/AAK server should
determine
   each CA whether accepts the pMSK and whether the peer could be
   attached to.
Question: I think it is should be " Before the keying materials are
delivered "  instead of "After" 

Regards 
Richard

---

From: Qin Wu <[email-masked]>
Date: Fri, 25 Jun 2010 15:38:11 +0800

Hi,Richard:
Thank for your comments. Please see my reply belows.
----- Original Message ----- 
From: "young" <[email-masked]>
To: <[email-masked]>
Sent: Monday, June 21, 2010 5:27 PM
Subject: [HOKEY] Some comments to the draft-ietf-hokey-erp-aak-02

>   authentication and CAP(s) have been discovered.

[Qin]: The assumption for CAP discovery has been implicitly indicated in the first paragraph of section 3, which mentioned as follows:
"
   The document also specifies a method by which the SAP may send the
   identities of neighboring attachment points to the peer in the EAP-
   Initiate/Re-auth-Start message.

"

> Question：How the peer get the CAP(s)' NAS-Identifier?

[Qin]: As described in paragraph 3 of section 3, the CAP(s)'s NAS-Identifier 
will be carried in early authentication request message and sent to the peer.

>   The ERP/AAK server transports the pMSK to the CAP(s) via AAA as described

[Qin]: Sounds reasonable to me, thanks.

> determine each CA whether accepts the pMSK and whether the peer could be
>  attached to.

[Qin]: You have a good catching. I agree that the description here has a little ambiguity.
It does explicitly tell us who determine which of CAs become the final target Authenticator. If the ERP/AAK server
can determine this, the ERP/AAK server need to query each CA to see which CA the peer is actually attached to and whether
this CA can support ERP/AAK. If the CA is really attached to one CA and this CA also support ERP/AAK, and then
this CA can tell ERP/AAK server that "I am the real target authenticator". And ERP/AAK then know this.
But if the peer determine this, the peer will send only one selected CAP's NAS-Identifier to the ERP/AAK server.
If the CA determine this, it does not make sense. becos when each CA can determine itself become Target Authenticator, 
this will introduce race control between each other.
Anyway, we will fix this in the next version.

> Regards 
> Richard
> 
> 
> _______________________________________________
> HOKEY mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hokey
>