Subject: [HOKEY] About the CAP determination logic

From: young <[email-masked]>
Date: Tue, 06 Jul 2010 15:46:01 +0800

Hi, All:

In the section 3 of the draft draft-ietf-hokey-erp-aak-02.txt, 
It says: After the keying materials are delivered, the ERP/AAK server should
determine each CA whether accepts the pMSK and whether the peer could be
attached to.

I think the logic to decide whether the peer could be attached to should be
done
By AAA server instead of by ERP/AAK server. 
It is a logic related to something like access control policy, and is out of
the scope of authentication.

Kindly let me know your option.

Regards
Richard

---

From: "Glen Zorn" <[email-masked]>
Date: Tue, 6 Jul 2010 15:56:43 +0700

> Kindly let me know your option.

I agree that the ERP/AAK server should not be involved in this decision but
OTOH it's not clear to me that the decision can be made by the HAAA either.
Indeed, it's not at all clear to me how the ERP/AAK server can 'authenticate
and authorize the CAP(s) presented in the NAS-Identifier TLV(s)', since NASs
& ERP/AAK reside at different layers.  For that matter, I'm not sure how the
keys for multiple CAPs can be distributed short of spraying them about; I
think that the draft should just define ERP/AAK operation WRT to a single
CAP & leave the issue of multiple CAPS for later resolution (if necessary).

...