Re: [HOKEY] Last Call: draft-ietf-hokey-reauth-ps

Charles Clancy wrote:
> WRT AAA proxies, they were not discussed because the PS document makes
> no assumption that AAA will be used for key distribution.

  What else would be used?  This is not a theoretical question...

> WRT key hierarchies, the document says "If a key hierarchy is
> deployed..." so again we don't make any assumption about what the
> solution will be.  We only say that if a hierarchy is used it must not
> be susceptible to the domino effect.

  The document spends a lot of time explaining key hierarchies without
describing the problem that the hierarchies solves.

> Same thing for the architectural diagram... the goal was to minimize our
> influence on the solution -- we're just trying to state the problem.

  I have no idea what problem the document is solving, because it is
carefully not referencing existing definitions, practices or systems.

  The point of such references is not to constrain the solution, but to
define common terms for understanding.  It is not clear to me how this
system would be used in an AAA environment, which is the overwhelmingly
dominant use of EAP.  I don't think that the authors know either.

  As evidence, every attempt to ask questions about real-world (i.e.
AAA) uses of this solution results in discussions of key hierarchies.
You say "IF a hierarchy is used", yet the majority of discussion is
centered around such hierarchies.  This makes it seem like key
hierarchies are a requirement.

  I think the document needs a lot more clarity on WHO is doing WHAT and
WHY.

  Alan DeKok.
_______________________________________________
HOKEY mailing list
HOKEY@ietf.org
http://www.ietf.org/mailman/listinfo/hokey