Re: [Dime] Comments on section 3 of new version draft-ietf-dime-erp-01

[Sebastien Decugis <sdecugis at nict.go.jp>]

Hi, again :)

> [Qin]: Since DSRK is calculated based the Domain name, given home domain name
> in the home domain I am wondering whether we can derive home domain specific DSRK
> based on the home domain name?
>   
It would seem quite logical, but the RFC5295/5296 currently specify a
different mechanism for the home domain (rRK)... So no, currently we
cannot do that unfortunately.

> [Qin]: Okay, I agree with your explainnation. However I have two followup comments as follows:
> 1. The home EAP server that uses ERP is the home ER server or not?
>   
Can you define the "home ER server" in the context of your question? We
don't use this in the document, I think this terminology is too vague,
sorry...
> 2. Who actually authorize the use of ERP, home EAP server or home ER server?
>   
The home EAP server when it derives the DSRK from the EMSK, and provide
it to a foreign ER server.

> [Qin]: I agree, without this assumption, it seems ERP exchange and EAP 
> Re-authentication operations on the peer, authenticator and server will
> be complicated.
> I wonder what do you think of the case where the home realm contains several
>  EAP servers described in the "open issues"section? Isn't it the same thing?
>   
Unfortunately, the architecture for EAP is already defined, so we cannot
change it, and it has different assumptions (which are justified because
each EAP server may support a different set of EAP methods). So, we have
to deal with it, as described in the open issues...

BR
Sebastien.

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)