RE: [HOKEY] Review of draft-gaonkar-radext-erp-attrs-02.txt

["Narayanan, Vidya" <[e-mail]>]

Hi Dan,

> 
>   But this rRK business is from a different key hierarchy 
> defined in a different document, right? It's _below_ the 
> whole EMSK-USRK-DSRK-DSUSRK tree you drew above, right? So I 
> don't really see how that justifies all the cruft above it.
> 
>   regards,
> 
>   Dan.
> 

Perhaps this is the crux of the misunderstanding.  The rRK is a USRK.
The EMSK hierarchy document just generically defines how USRKs are
derived, since multiple usages could define their own root keys.  For
reauthentication purposes, rRK is defined and it is defined in the ERX
document.  

The DSRK is also a USRK - just a special case, where instead of a
"usage", it is meant for another domain outside the home domain.  The
DSUSRK is a USRK specific to that domain - so, an rRK specific to a
domain would belong there.  

So, we have: EMSK --> rRK for the home domain and EMSK --> DSRK --> rRK
for a visited domain.  

The latter hierarchy for a visited domain allows other usage keys for
the local domain to come out of the DSRK, just like other usage keys for
the home domain can come from the EMSK.  This allows the distribution of
one key at the time of authentication that may then be used for various
service keying needs within the domain.  If we derived an rRK and
distributed that out, then, for every local service, a key must be
requested from the home domain and this is not desirable.  

Hope that clarifies things and brings us closer to being on the same
page. 

Regards,
Vidya

_______________________________________________
HOKEY mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/hokey