Subject: [HOKEY] <draft-hoeper-hokey-arch-design-03>

From: "Hoeper Katrin-QWKN37" <[email-masked]>
Date: Wed, 4 Aug 2010 12:28:34 -0400

Hi,

I would like to request that the "Handover Keying (HOKEY) Architecture
Design" draft
(http://www.ietf.org/id/draft-hoeper-hokey-arch-design-03.txt) becomes a
Working Group item.

Unfortunately there was no slot to discuss this draft at the last IETF
meeting, which is why I am bringing this to the list now.

The draft has been discussed at two previous meetings (76&77) and its
importance for the group was acknowledged. A new draft addressing all
previous issues has been posted mid July. 

For these reasons, I believe the draft is ready to be adopted as a WG
item.

Regards,

Katrin

---

From: Qin Wu <[email-masked]>
Date: Tue, 17 Aug 2010 10:33:16 +0800

Hi,
I have read this draft and believe it and is ready to accepted as WG item.

please find my few comments below.

Section 4.1 System Overview
"
   o  discovery of the authentication services supported at a given
      candidate access point;
"
[Qin]: It is not clear what is authentication services. How does it distinguish from AAA service. Suggest to
change
"
   o  discovery of the authentication services supported at a given
      candidate access point;
"
in section 4.1 as:
"
   o  discovery of the authentication services (i.e., Re-authentication, EAP Early Authentication)supported at a given
      candidate access point;
"

Section 4.1. System Overview
"
   o  discovery of the required server in the home domain when a
      candidate access point is not in the same domain as the serving
      attachment point, or no local server is available;
"
[Qin]: It is not necessary to emphasize the server to be discovered MUST be in the home domain. 
The server can be discovered based on Realm name, whether or not it is in the home domain. Suggest to change
"
   o  discovery of the required server in the home domain when a
      candidate access point is not in the same domain as the serving
      attachment point, or no local server is available;
"
in the section 4.1 as:
"
   o  discovery of the required server in the domain when a
      candidate access point is not in the same domain as the serving
      attachment point;
"

   +------------------------------------------------------------+
   |   AAA Network Access Authentication and Authorization      |
   +---+-------------.----------------------------+-------------+
       |            /|\                           |
       |             |  Authentication subsystem  |
   +===|=============|============================|=============+
   |   |   +---------+----------+   +-------------V---------+   |
   |   |   |    Direct and      |   | EAP Re-authentication |   |
   |   |   |      Indirect      |   +--+------+-------------+   |
   |   |   | Pre-Authentication |     /      /                  |
   |   |   +--------------------+    /      /                   |
   |   |                            /      / +---------------+  |
   |   |                           /      |  | Authenticated |  |
   |   |                          /       |  | Anticipatory  |  |
   |   |                         /        |  | Keying (AAK)  |  |
   |   |                        /         |  +-------+-------+  |
   |   |                       /          |          |          |
   | +-V------------------+   / +---------V----------V--------+ |
   | | EAP Authentication |  |  |       ER Key Management     | |
   | +---------+----------+  |  |+------------+ +------------+| |
   |           |             |  ||Handover Key| |Handover Key|| |
   |           |             |  || Derivation | |Distribution|| |
   |           |             |  |+------------+ +------+-----+| |
   |           |             |  +----------------------|------+ |
   +===========|=============|=========================|========+
               |             |                         |
   +-----------V-------------V-------------------------V--------+
   |             AAA routing and secure transport               |
   +------------------------------------------------------------+

[Qin]: I am difficult to believe the Authentication Subsystem include key management system.
Suggest to change "Authentication Subsystem" into "Hokey Subsystem"

Regards!
-Qin
  ----- Original Message ----- 
  From: Hoeper Katrin-QWKN37 
  To: [email-masked] 
  Sent: Thursday, August 05, 2010 12:28 AM
  Subject: [HOKEY] <draft-hoeper-hokey-arch-design-03>

  Hi,

  I would like to request that the "Handover Keying (HOKEY) Architecture Design" draft (http://www.ietf.org/id/draft-hoeper-hokey-arch-design-03.txt) becomes a Working Group item.

  Unfortunately there was no slot to discuss this draft at the last IETF meeting, which is why I am bringing this to the list now.

  The draft has been discussed at two previous meetings (76&77) and its importance for the group was acknowledged. A new draft addressing all previous issues has been posted mid July. 

  For these reasons, I believe the draft is ready to be adopted as a WG item.

  Regards,

  Katrin 

------------------------------------------------------------------------------

  _______________________________________________
  HOKEY mailing list
  [email-masked]
  https://www.ietf.org/mailman/listinfo/hokey