Subject: [HOKEY] WGLC on draft-ietf-hokey-arch-design

From: Glen Zorn <[email-masked]>
Date: Thu, 04 Aug 2011 18:26:03 +0700

At the hokey WG session during IETF 81 last week, the beginning of a two
week Working Group Last Call for this document was announced. However,
it appears that no-one mentioned this fact on the mailing list :-(, so
the Last Call will be extended to 18 August. A URL for this document is
http://www.ietf.org/id/draft-ietf-hokey-arch-design-04.txt. Please note
that the draft is only 21 pages long; we read through about half of it
during the session in about half an hour, so reading it should not be a
major task. Reply to this message with any comments (including
statements such as "I read it and it's fine"). Thank you.

---

From: andy L <[email-masked]>
Date: Fri, 5 Aug 2011 16:24:04 +0800

I think the draft is neat, but for one point, I think it is a typo, please
check this line in page 4,[ Early authentication includes direct  and
indirect pre-authentication as well as Authenticated Anticipatory   Keying
(AKK)], Authenticated Anticipatory   Keying should be abbreviated as AAK.
Liu, Shu

2011/8/4 Glen Zorn <[email-masked]>

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.14 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iQEcBAEBAgAGBQJOOoHKAAoJEG4XtfZZU7Rf2R8H/RtK8TWkpZkjPmC3ilDKk8x9
> GHa3a8A8Hx2u87VTRo8EerNMue6zE1xVfroRY58UsDidvwIxC7To3ixqq5j0srph
> 2IPoMFVqoxOLlI2XQ2TcFxWoPOcadKyoGn89b6FIrDwgynfuEdYIg1eELv0DOtjo
> n1lt2KKGZaPUG57uHFSEzcGatehGMmKCxKPTfiSwpJTIQFvt4YEHBIWZqj88rJnh
> PPbi4b6DC/4L25t6C0/aeeau+88kJfYpsxjr3cQxvdSmt0690MUftioBHVnJKXaz
> UeM/iw2YQiJk1x6TVMwk6Yvz6/3bSlpBdCFecnvIBhM0RnPRonBpybg7U6KbllA=
> =1Zpm
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> HOKEY mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hokey
>
>

---

From: Zhen Cao <[email-masked]>
Date: Wed, 10 Aug 2011 11:38:01 +0800

I have read the latest (draft-ietf-hokey-arch-design) version of this
draft and think it is ready for publication. However I have some
additional comments to this draft below:
Section 1, It said
"
whereas in AAK the client interacts with the AAA to discover and
connect to CAPs.
"
[Z]: How to understand "discover"? It seems for AAK, there are
potentially two possible cases.
case 1: the client has already discovered a list of CAPs and negotiate
with the AAA to choose one appropriate CAP from the CAPs list.
case 2: the client only knows a layer-2 identifier as index and then
the client use index to lookup appropirate CAP by interacting with the
AAA. which case is correct?

Section 3.1.2 "Minimized User Interaction for authorization"
[Z]: This section seems redundant since the previous section has
already cover this case. Suggest to merge section 3.1.2 into section
3.1.1 or just delete the section 3.1.2.

Section 6:
[Z]:In Quebec meeting, the case where multiple servers are located in
the same domain has been
well discussed. I am thinking if this case should be taken into
account in this section or leave
this case out of scope of hokey architecture?

-- 
Best regards,
Zhen

---

From: andy L <[email-masked]>
Date: Thu, 11 Aug 2011 15:29:15 +0800

please check section 5.4 and section 9, I have one question.
as we know, re-auth message has SEQ field, is a new TV for sequence number
still required?

andrew liu