Re: [secdir] SECDIR review of draft-ietf-hokey-key-mgm

On Aug 10, 2009, at 10:29 AM, Glen Zorn wrote:

> Kurt Zeilenga [mailto://Kurt.Zeilenga@Isode.com] writes:
>
> ...
>
>> The security consideration starts by saying:
>>    This section provides security requirements and an analysis on
>> transporting EAP keying material using an AAA protocol.
>> While 6.1 appears to provide the former, 6.2 (the remaining section)
>> seems to discuss a particular concern in transporting EAP keying
>> material in an APP protocol.
>
> No.  AFAIK, the only existing protocols in which EAP key transport  
> take
> place are AAA.

My point that Section 6 description of what section 6.2 provides seems  
not equate (to me) to what 6.2 actually provides.  6.2 seems to  
discuss a particular issue in "transporting EAP keying material using  
an AAA protocol" as opposed to a more comprehensive "analysis on  
transporting EAP keying material using an AAA protocol".

> ? Is this the only concern?
>
> I would assume so; does that need to be spelled out?

Not necessarily.

>
>> I would like to see the Security Consideration section to incorporate
>> by informative references general discussions of security
>> considerations for key technologies (e.g., EAP).
>
> Why?  The EAP (or ERP) authentication is by definition complete by  
> the time
> any keys are exported by the EAP method, so it's hard to see how those
> considerations are relevant.

As the document discusses use of KDE in ERP, it would seem to me that  
ERP security considerations would have some relevance.  I find  
statements such as:

	ERP security considerations are discussed in [RFCxxxx].  EAP security  
considerations are discussed in [RFCyyyy].

useful as they further encourage the reader to consider security  
considerations of key technologies.

>
>> Beyond this, I'm afraid I do not have sufficient experience in the  
>> key
>> technologies to be able to determine if security considerations are
>> well covered or not.
>> Regards, Kurt
>>
>>
>>
>>
>> _______________________________________________
>> secdir mailing list
>> secdir@ietf.org
>> https://www.ietf.org/mailman/listinfo/secdir
>