Subject: [HOKEY] ERP with one ER server vs ERP with multiple ER servers

From: Qin Wu <[email-masked]>
Date: Sat, 16 Oct 2010 10:41:08 +0800

Hi,
As described in RFC5296,ERP can be performed in two different ways:
a) ERP with one ER server
b) ERP with multiple ER servers

As for a), RFC5296 allows three different use cases
case 1: Peer -> ER authenticator -> Local ER server
case 2: Peer -> ER authenticator -> home ER server
case 3: Peer -> EAP authenticator/ER authenticator ->Local ER server -> Home EAP server 
case 3 also can be called as ER implicit bootstapping

As for b), RFC5296 allows the following use case:
case 4: Peer -> ER authenticator -> local ER server -> home ER server 
If the peer run ERP exchange with bootstapping flag on, case 4 calso can be called as ER explicit bootstapping.
I was thinking why we SHOULD allow ERP with multiple ER servers? 
Since case 3 can be utilized to push DSRK to the local ER server and the peer can choose to run local ERP exchange
with local ER server, why we need case 4. Why not restrict the ERP with only one ER server or the ERP with the local ER server
in the domain as the peer? 

Also if you read the last paragraph of section 5.3.2.1 of RFC5296
"
   If the peer has already
   initiated an ERP exchange with the home ER server, it MAY choose to
   not start an ERP exchange with the local ER server.
"
You will find this paragph is contradict with the case 4 (Peer -> ER authenticator -> local ER server -> home ER server ) and description of section 5.1 of RFC5296.
"
   it SHOULD initiate ERP bootstrap exchange (ERP exchange with
   the bootstrap flag turned on) with *the home ER server * to obtain the
   domain name.  The *local ER server* behavior is the same as described
   above.  The peer MAY also initiate bootstrapping to fetch information
   such as the rRK lifetime from the AAA server.
"
In order to address this issue, we may have two choice to avoid overdesign for ERP
a) restrict the ERP with only one ER server
b) the ERP with the local ER server in the domain as the peer
Personally I prefer the choice a), becos few changes are needed for RFC5296.

Regards!
-Qin