Subject: [HOKEY] RE: Issue list: EMSK document rev: key management domain

From: "Nakhjiri Madjid-VXT746" <[email-masked]>
Date: Tue, 20 Nov 2007 15:16:31 -0500

Hi Charles, 

I just looked at the issue list for EMSK hierarchy draft. Thanks for
capturing the "key management domain" discussion.

-I am just looking at the terminology section and I see that the current

definition of key management domain makes this DSRK something very
unspecific. You are saying key management domain is a domain of entities
that have access to a key. According to the definition, any key has its
own domain of parties that can have access to it (which is fine),
however, the DSRK definition say:

"Keying material derived from the EMSK that is restricted to use in
      a specific key management domain." 
Now all of a sudden, we are saying keys that are specific to a key
management domain are special keys and are called DSRK, this is
extremely confusing and just going into circles. What additional
confusion of whether a domain is, administrative, or AAA or key
management domain, I don't know the draft terminology section leaves a
lot of room for confusion.

-Then there are requirements such as  

"Derivation of DSRKs and USRKs MUST be specified such that no
      domain can obtain a USRK by providing a domain name identical to a
      Usage Key Label."

Where it is not clear what domain is, even worse what the domain ID is.

-The same issue propagates down to DSUSRK.

-Also the doc is suggesting that negotiation of PRF is possible as part
of EAP method. Is this also possible as part of 3 party key exchange
that delivers USRK/DSRK or we think there will be issue with
coordinating across USRKs/DSRKs?

-Do we need to deal with methods that do not produce EAP session ID when
naming the keys?

-section 4 obviously requires rewording.

Madjid

-----Original Message-----
From: Nakhjiri Madjid-VXT746 
Sent: Tuesday, November 20, 2007 10:57 AM
To: Charles Clancy
Cc: Lakshminath Dondeti; Joseph Salowey (jsalowey); Narayanan, Vidya;
Glen Zorn; Nakhjiri Madjid-VXT746
Subject: RE: Issue list: EMSK document rev: key management domain

Hi Charles,

Key scope terminology makes it a lot easier to sanity check our
documents with Russ and Bernards doc. So I support that over "key
management domain".

The other issue that I have is that it seems that the D in DSRK is now
tying to key management domain rather than administrative/AAA domain and
with this new spin, it seems everything will go in a circle and is very
confusing. So the D needs to be explained clearly now.

If we can get the new document to clear the inconsistencies, it would be
great. Still, If you like I can read the doc and submit formal issues. 

Regards,

Madjid

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]]
Sent: Tuesday, November 20, 2007 4:40 AM
To: Nakhjiri Madjid-VXT746
Cc: Lakshminath Dondeti; Joseph Salowey (jsalowey); Narayanan, Vidya;
Glen Zorn
Subject: Re: Issue list: EMSK document rev: key management domain

The key scope terminology seems reasonable to me.  Do the authors have
consensus that this is the appropriate route?

If so, then I suggest the document be revised to reflect this more
consistent terminology.  The only open issue, as far as I understand the
discussion, relates specifically to this topic.  We can formally submit
the new doc after Vancouver that hopefully all the authors are happy
with.  Then we can talk about WGLC.

-- 
t. charles clancy, ph.d.                 eng.umd.edu/~tcc
electrical & computer engineering, university of maryland

Nakhjiri Madjid-VXT746 wrote:
> Hi Charles,
> 
> It seems that we are reaching agreements on use of a derivative of 
> "key scope" instead of key management domain. I think we also agreed 
> that we should remove the notion of administrative domain (not sure if

> AAA domains are better).
> 
> I wanted to read through the entire doc before providing a list. I am 
> actually quite confused as to what domain the D in DSRK refers to now,

> I had always assumed it was adminstrative domain. It would be more 
> efficient if I go through the draft once this change is reflected in 
> the doc, so we can check for consistency throughout the doc and take 
> care of editorial issues as well. Otherwise, it would be a moving 
> target, do you agree?
> 
> Madjid
> 
> -----Original Message-----
> From: Charles Clancy [mailto:[email-masked]]
> Sent: Monday, November 19, 2007 12:40 PM
> To: Nakhjiri Madjid-VXT746; Lakshminath Dondeti
> Cc: Joseph Salowey (jsalowey); Narayanan, Vidya; Glen Zorn; Charles 
> Clancy; Nakhjiri Madjid-VXT746
> Subject: RE: EMSK document rev: key management domain
> 
> Madjid,
> 
> Can you send me a list of your concerns not addressed in the latest 
> rev in issue form? Then I'll add each to the tracker. That way we can 
> make sure they will be addressed.
> 
> -----Original Message-----
> From: "Nakhjiri Madjid-VXT746" <[email-masked]>
> To: "Lakshminath Dondeti" <[email-masked]>
> Cc: "Joseph Salowey (jsalowey)" <[email-masked]>; "Narayanan,
Vidya"
> <[email-masked]>; "Glen Zorn" <[email-masked]>; "Charles 
> Clancy" <[email-masked]>; "Nakhjiri Madjid-VXT746"
> <[email-masked]>
> Sent: 11/19/2007 3:09 PM
> Subject: RE: EMSK document rev: key management domain
> 
> Unless there is a technical comment to be added to this discussion, I 
> appreciate to not get shot down or deferred to a later date, every 
> time as a co-author I bring up an issue.
> 
> This is one group in IETF that really insists on resolving EVERYTHING 
> AT the meeting and I don't think this is how IETF is supposed to
operate.
> 
> Madjid
> 
> -----Original Message-----
> From: Lakshminath Dondeti [mailto:[email-masked]]
> Sent: Monday, November 19, 2007 12:02 PM
> To: Nakhjiri Madjid-VXT746
> Cc: Joseph Salowey (jsalowey); Narayanan, Vidya; Glen Zorn; Charles 
> Clancy
> Subject: Re: EMSK document rev: key management domain
> 
> I hope Key Scoping and other 4962 "compliance" issues will get 
> resolved during the Vancouver meeting and we don't have to wait for 
> another meeting cycle.  I see that Charles and Glen have proactively 
> scheduled a presentation by Russ and possibly a discussion afterwards 
> to resolve these issues that we have been dealing with in advancing 
> drafts on EAP keying.
> 
> Charles and Glen, thank you for scheduling Russ's talk.
> 
> Joe, thanks for submitting the draft.
> 
> regards,
> Lakshminath
> 

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey