Subject: Re: [HOKEY] REMINDER: WGLC on draft-ietf-hokey-erp-aak-04

From: Qin Wu <[email-masked]>
Date: Mon, 29 Aug 2011 16:18:38 +0800

Follwing this thread on multiple CA case, if we really want to support this case,
we need to well clarify the following question in the new version:

If there are multiple CAPs situated at the neighbouring of SAP,
 how SAP interact with the AAA to demine the right CAPs?

Regards!
-Qin
----- Original Message ----- 
From: "Qin Wu" <[email-masked]>
To: "Glen Zorn" <[email-masked]>; "Zhen Cao" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, August 29, 2011 4:07 PM
Subject: Re: [HOKEY] REMINDER: WGLC on draft-ietf-hokey-erp-aak-04

> Hi,
> Sorry to chime in.
> ----- Original Message ----- 
> From: "Glen Zorn" <[email-masked]>
> To: "Zhen Cao" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Tuesday, August 23, 2011 3:37 PM
> Subject: Re: [HOKEY] REMINDER: WGLC on draft-ietf-hokey-erp-aak-04
> 
> 
>> On 8/23/2011 12:18 PM, Zhen Cao wrote:
>> 
>>> Thank you, Andy, See inline.
>>> 
>>> On Tue, Aug 9, 2011 at 5:16 PM, andy L <[email-masked]> wrote:
>>>> first of all, I have read, it is fine.
>>>> still I have some comments
>>>> 1 since it is said in Chapter 3 /*This document   only discusses the case of
>>>> distributing the key to a single CAP.*/ the statement like /*To  avoid the
>>>> same pre-established Master Session Key (pMSK) being   derived for multiple
>>>> CAPs, the sequence number MUST be nique for   each CAP.*/ is not so
>>>> necessary.
>> 
>> Is that true?  The document only discusses deriving the for on CAP _at a
>> time_; do you really think it's OK for the same key to be used with the
>> next CAP in a series of moves??
> 
> [Qin]: My answer to your last question above is "No". I think it is not harmful to allow the key to be distributed 
> multiple CAs when the client doesn't really know where to move.
> However if client has already know which is the next CA he is going to attach to, I think the case of
> distributing the key to a single CAP should apply here. 
> Does my clarification make sense to you?
> 
>> ...
>> _______________________________________________
>> HOKEY mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/hokey