Re: [HOKEY] Review of draft-gaonkar-radext-erp-attrs-02.txt

[Lakshminath Dondeti <[e-mail]>]

Hi Alan,

Sorry for the delay.  Some other IETF work preempted this discussion in 
my priority list.

The notion of domains and key delivery for different domains is in fact 
in the charter and there is even a specific deliverable:

Sep 2007	  	Submit Protocol and Keying Hierarchy for Visited Domain 
Handovers and Re-authentication draft to IESG.

BTW, I noticed that most if not all HOKEY deliverables are marked 
"Done."  It is really great to see that; kudos to the chairs and working 
group contributors for this achievement!

regards,
Lakshminath

On 1/14/2008 7:37 AM, Alan DeKok wrote:
> Lakshminath Dondeti wrote:
>> Requirement: DSRKs are necessary
>> * Why?
>>> Several reasons: Have a key in each domain to do local services.
>> Reauthentication being one of them.  The USRK/rRK would provide such
>> services at home; is not sent out of the home domain, so let's keep it
>> that way.  Derive a key per domain and send it.
> 
>   My reading of the charter, and recent discussions, indicates that
> HOKEY is intended to target re-authentication within one domain
> (*.example.com), and not across domains (example.com -> example.net).
> If so, then I would like to know more about the need for keys in
> sub-domains, e.g. *.example.com.
> 
>   To a very large extent, the key distribution issue within example.com
> is completely up to example.com.  HOKEY could simply say "example.com
> caches the re-authentication key, and uses that to re-authenticate the
> user".  The exact mechanism is implementation-dependent.
> 
>   Alan DeKok.
> 

_______________________________________________
HOKEY mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/hokey