Re: [Dime] New version of draft-wu-dime-local-keytran

Hi Glen, Qin, all,

By quickly looking into the new version, a few additional comments came
to my mind:

In section 3.1, I would like to propose a change to the ABNF. I think
the Key-Type AVP should be in a fixed position (actually I was under the
impression that this was already decided, but anyway), like this:

   Key ::= < AVP Header: AC1 >
             < Key-Type >
             ...

In section 3.1.1 (definition of Key-Type AVP), I think some of the
defined values should be removed, as follow:
- rMSK (4) : As I understand, there is no difference between rMSK and
MSK, so we may not need a different type for this one ? (not sure)
- USRK (2) & DSUSRK (5): RFC5295 defines a generic algorithm to derive
usage-specific keys. The definition alone is not sufficient to create
keying material: we need the usage itself to define the missing parts.
Therefore, having a "USRK" or "DSUSRK" container is pointless, it does
not allow the recipient to understand what is in the key. On the other
hand, rRK and rDSRK make sense, since ERP defines completely the
algorithm (they are instances of USRK and DSUSRK). Anyway, I guess it
would make more sense that the rRK and rDSRK values are assigned in the
registry by Diameter ERP document, if needed. But this is not very
important. As a summary, I believe an initial version the document
should only define MSK and DSRK Key-Type values.

I section 4, maybe a bit of explanation about the Key-Type and Key-Name
AVPs inside DER / DEA would be useful. From the remaining of the
document, I had only guessed that the Key AVP could be present in DEA,
and nothing about the other ones.

I believe the "Security Considerations" section should also reference
RFC5295's security section, especially Section 7.4 (Key Distribution),
and mention that Diameter honors these security requirements. It should
also mention that different key usages may have stronger security
requirements, that must be carefully considered before using the
mechanism defined in this document.

That's all I have for the moment :) Sorry for the long mail!

Best regards,
Sebastien.

Glen Zorn a écrit :
> FYI, http://www.ietf.org/id/draft-wu-dime-local-keytran-03.txt has been
> posted; we think that all outstanding comments have been addressed.
>
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime
>
>   

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)