Re: [Dime] Review of draft-ietf-dime-local-keytran-03

["Glen Zorn" <[e-mail]>]

Joseph Salowey  <mailto:[mailto://[e-mail]%5d>
[mailto://[e-mail]] writes:

 

I think this specification is useful.    Here are some  comments:

 

1.       Key types -  The document lists USRK and DSUSRK as key types.
These are a class of keys and do not necessarily refer to a specific
application.  How would one represent different USRKs for different usages?
Are rMSK and rRK examples of USRKs?  

Any recommendations?

2.       IN 3.1.2 and 3.1.3 it mentions that this depends upon the link
layer.  Could these keys be used for other purposes  (say at the IP layer)?
If they could perhaps it would be better to say "usage" instead of link
layer.   If not then the current text is fine.  

Good idea, I can make that change (see below).

3.       The key lifetime is specified from when the key is first used.   In
this case if there is a long period of time between when the key is
generated and used then the key life time may exceed the lifetime of the
root key.   This indicates that the key generator can't determine when a
particular set of keys  will expire.  Is this what is desired?  Why not
start the timer from when it is received?  

OK

4.       Key-SPI - is there a particular example for a usage of this?   How
does it differ from key ID?  

Check
<https://datatracker.ietf.org/doc/draft-ietf-dime-ikev2-psk-diameter/>
https://datatracker.ietf.org/doc/draft-ietf-dime-ikev2-psk-diameter/.  In
fact, this AVP was added in response to a request from the authors of that
draft, so that they remove the key-related stuff from that document (which
is, unfortunately, yet to be updated).

5.       Section 3.1 states certain attributes as optional it seems that key
name is also optional so it seems the text is a bit misleading.   

Good point.  How's this:

   The Key AVP (AVP Code <AC1>) is of type Grouped [RFC3588] It contains the
type and 

   keying material and optionally an indication of the usable lifetime of
the key, the 

   name of the key and a SPI with which the key is associated.

You might also mention that additional attributes can be defined to pertain
to a key (I think this is the case from the  *[ AVP ]

OK

Joe