Re: [Dime] [HOKEY] DiME ERP: new Application ID or not ?(non-roaming case)

[Qin Wu <sunseawq at huawei.com>]

Hi,
Sorry for the late reply.
----- Original Message ----- 
From: "Sebastien Decugis" <sdecugis at nict.go.jp>
To: "Qin Wu" <sunseawq at huawei.com>
Cc: "Julien Bournelle" <julien.bournelle at gmail.com>; <dime at ietf.org>; <hokey at ietf.org>
Sent: Tuesday, March 17, 2009 2:05 PM
Subject: Re: [Dime] [HOKEY] DiME ERP: new Application ID or not ?(non-roaming case)


> Hi,
> 
> Thank you for yor answer, and sorry for replying so late myself.
> 
> Qin Wu a écrit :
>> Hi,Sebastien:
>> The MSK and EMSK both result from EAP authentiction and are used to derive other keys.
>> Also both MSK and EMSK are shared between the peer and the AAA server. So MSK has the same lifetime as EMSK, what's more, the derived keys also has the same lifetime as MSK or EMSK.
>>
>> As regarding the second question, since the keying materials is established through the EAP exchange between the peer and the server and shared between the corresponding two entities. I am sure the peer and the AAA server should agree on the lifetime of these keys firstly. With respect to how much is the lifetime of keys, it mostly depends on the specific implementation.
>>   
> 
> Since ERP would use material derived from the EMSK, I guess that when
> the MSK is expiring then an ERP exchange cannot occur, and therefore we
> don't really have a choice here, but to use full EAP.
> 
> This brings the following conclusion (please correct me if I am wrong):
> ERP is only used when the peer attaches to a new authenticator while
> having a valid authentication material (EMSK).
[Qin]: 
According to the RFC 5296, ERP is also used when ERP bootstrapping happens, 
Here ERP bootstapping is quite different from MIPv6 bootstrapping. What ERP bootstrapping means the how the DSRK is generated and distributed to the peer via EAP basic four message (i.e., EAP request/response, EAP success/failure)

On the other hand, ERP is also used in the inter-authenticator handover scenarios in  which EAP Initiate/Finish is used to complete Re-authentiation.

> I am not sure anyway how this is related to the {EAP or new} application
> ID problem.

[Qin]: 
As regarding to how this is related to the application, I think ERP mechanism is quite different from regular EAP authentication mechanism. ER server can be 
indpendent AAA server which can be proprietary.

> Best regards,
> Sebastien.
> 
> -- 
> Sebastien Decugis
> Research fellow
> Network Architecture Group
> NICT (nict.go.jp)
>