Subject: [HOKEY] Change proposal for ERP-AAK - 8: Check fail processing

From: Qin Wu <[email-masked]>
Date: Thu, 29 Sep 2011 18:28:37 +0800

Hi,
In the section 3 of draft-ietf-hokey-erp-aak, we didn't consider what the server does if check failing happens.
Therefore I propose to do the following change to the section 3:
OLD TEXT:
"
   Upon receiving the message, the ERP/AAK server first checks its
   integrity and freshness, then authorizes the CAP presented in the
   NAS-Identifier TLV(s) via the NAS-Identifier.  
"
NEW TEXT

"
Upon receiving the message, the ERP/AAK server first verifies 
the authentication of the peer by checking username portion of 
KeyName-NAI and checks its integrity and freshness and, then 
verifies if the value(s) contained in the CAP-Identifier conflict with
 NAS-Identifier for SAP. Next,authenticates and authorizes the 
CAP(s) presented in the NAS-Identifier TLV(s). If any of the checks
 fail, the server sends an the early-authentication finish message 
(EAP-Finish/Re-auth with E-flag set) with the Result flag set to '1'. 
"

OLD TEXT:
"
   The ERP/AAK server transports the pMSK to the authenticated and
   authorized CAP(s) via AAA as described in Section 7.

   Finally, the ERP/AAK server sends the early-authentication finish
   message (EAP-Finish/Re-auth with E-flag set) containing the
   determined CAP to the peer via the SAP.

"
NEW TEXT:
"
   The ERP/AAK server transports the pMSK(s) respectively to the authenticated 

   and authorized CAP(s) via AAA as described in Section 7.  After the

   keying materials are delivered, the ERP/AAK server should determine

   each CA whether accepts the pMSK and whether the peer could be

   attached to by interacting with the CA via AAA message. If the ERP/AAK

   server knows the CA does not support ERP, it should sends an the early-authentication

   finish message (EAP-Finish/Re-auth with E-flag set) with the Result flag set to '1'.

   Otherwise, the ERP/AAK server sends the early-authentication finish

   message (EAP-Finish/Re-auth with E-flag set) containing the

   determined CAP(s) to the peer via the SAP. 

"

Regards!
-Qin