Re: [Dime] Comments on section 2 of new version draft-ietf-dime-erp-01

[Sebastien Decugis <sdecugis at nict.go.jp>]

Hi,

Sorry for late answer.

> [Qin]: Sorry for your misunderstanding here. what I want to say here is
> suppose both the local ER server and the home ER server support *EAP*, 
>   
...
> we can simply assume the home EAP server and the peer has already export
> the same EMSK during the initial EAP exchange.
That's the base assumption of ERP, yes.
>  In this way, the Re-authentication
> root key can be derived  from EMSK. There is no extra delay to be introduced.
>   
Do you mean that intermediary nodes (such as local ER server) can derive
the EMSK also? This would be a security issue...

> [Qin]: Sorry for your misunderstanding, Here mentioned AAA server or AAA agent  is not third entity but the EAP sever.
> So it is not necessary to define new message for key exchange here. If the EAP sever is not able to derive ERP stuff,
> the ERP exchange will fail and fall back to the full EAP exchange.
>   
I think this is what is written in the document, yes...

> [Qin]: Okay.
> Suppose there is serveral EAP servers in the home domain, 
> If one EAP server can not use specific EAP method to export EMSK, why do we
> need to deploy such kind of EAP server? 
>   
There can be several EAP servers that are able to derive EMSK...

Sebastien.

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)