Subject: Re: [HOKEY] Review of draft-hoper-hokey-arch-design-02

From: Tom Taylor <[email-masked]>
Date: Thu, 08 Jul 2010 21:04:32 -0400

This is from your review of the architecture document. Are you saying we should
not consider any scenario where a local ER server is not collocated with a AAA
proxy?

As a general question to the Working Group: is there any real value in having an
ER server in the home domain that is not collocated with the home domain EAP
server?

On 14/4/2010 Qin Wu wrote:
> Hi,
...

    [RFC5296] specifies a method-independent re-
>    authentication protocol (ERP) applicable to two specific deployment
>    scenarios:
>    o  where the peer's home EAP server also performs re-authentication;
>       and
>    o  where a local re-authentication server exists but is collocated
>       with a AAA proxy within the domain.
>    One of the objectives of this document is to generalize the HOKEY
>    architecture beyond the specific cases dealt with by [RFC5296].
>    
>    [Qin]: Just for Clarification. I think the objectives of this document is
>    not to introduce some new scenarios or use cases but identify  
>    What the components of hokey architecture are? what is missing part in the 
>    hokey architecture.How they can put together to work? This is what we are doing now
>    in this document?
> 
...

---

From: Qin Wu <[email-masked]>
Date: Fri, 09 Jul 2010 10:52:25 +0800

Hi, Tom:
Go back to my review, I think my comment at that place is too general and very confusing. Sorry about that.
As you mentioned, there are two cases which are not covered by RFC5296:
a) the local ER server is separated from the local AAA sever 
b) the home ER server is separated from the home AAA server.
I believe that is true. 
However what I am not sure is whether we need to fix them in the RFC5296bis or 
we address these two extra cases in the Hokey architecture.

Another issue is I believe each ER server should support AAA protocol to interact with authenticator.
suppose we address these two cases in Hokey architecture, what's the 
main difference to the cases (i.e, the caess where the ER server 
is collocated with AAA server)specified in RFC5296? The only difference that occurs to my 
mind is new trigger from different separate entities and introduce new interface between two AAA entities. What else?
So I think maybe it is more sensible to discuss how the local ER server interact with the EAP server instead of AAA server?
In other words, how does the local ER server obtain new key materials from EAP server? Currently the problem is EAP sever may
not understand ERP message encapsulated in the AAA message.

Regards!
-Qin

---

From: "Glen Zorn" <[email-masked]>
Date: Sun, 11 Jul 2010 15:34:50 +0700

> ER server in the home domain that is not collocated with the home domain

A more interesting question, I think, is whether there should be any
distinction between "home" domain & any other.

...

---

From: Tom Taylor <[email-masked]>
Date: Sun, 11 Jul 2010 11:17:55 -0400

From a HOKEY point of view, the home domain is the domain containing the EAP 
server and the ER server that has to be involved in re-authentication if the 
mobile host moves between domains. And the reason "domain" has to enter the 
picture is so that local entities can discover the home entities.

---

From: "Glen Zorn" <[email-masked]>
Date: Sun, 11 Jul 2010 22:55:53 +0700

> picture is so that local entities can discover the home entities.

Is your position that AAA domains (heretofore invisible to EAP) are now
vital to the operation of hokey (aside from the derivation of a DSRK)?

...

---

From: Tom Taylor <[email-masked]>
Date: Sun, 11 Jul 2010 11:59:50 -0400

> vital to the operation of hokey (aside from the derivation of a DSRK)?
Tom Taylor replies:

I tried to phrase this independently of AAA. Discovery is a DNS issue, unless 
you make it otherwise.