Subject: Re: [Dime] New version of draft-wu-dime-local-keytran

From: Sebastien Decugis <[email-masked]>
Date: Thu, 07 Jan 2010 16:32:38 +0900

Hi Qin, all,

Sorry for the late reply.

> [Qin]: According to draft-ietf-hokey-key-mgm-13, USRK and DSUSRK can be used in
> Key Distribution Exchange Scenarios, that is to say EAP based key transportation is not limited for ERP
> specific usage. Also I am not saying using of USRK and DSUSRK in the ERP scenario. I am wondering 
> whether USRK and DSUSRK transportation can be used for other non ERP specific cases like Key Distribution 
> Exchange Scenarios.
>   

As far as I undertand :
- The draft you cite defines a framework for (EAP-based) key
distribution. It is to be used by any application that needs to
transport a key.
- USRK (resp DSUSRK) is a generic algorithm to derive some key material
from the EMSK. It is merely a template, and applications are free to use
it or not (by defining the "usage").

Therefore, in my understanding, there can be no instance of a "USRK",
only application keys derived following the algorithm given by USRK
(where the application specifies the parameters of the algorithm).

My point was only that having "USRK" and "DSUSRK" in the enumerated
field makes no sense at all. It will only confuse people who read the draft.

Best regards,
Sebastien.

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)

---

From: Qin Wu <[email-masked]>
Date: Fri, 08 Jan 2010 10:23:05 +0800

Hi,
In my understanding,
In ERP specific case, rRK is directly derived from USRK and DS-rRK is directly derived from DSUSRK.
wherein USRK is one instance of EMSK and DSUSRK is one instance of DSRK.

In Non-ERP specific case, I would like to refer to scenario 1 and scenario 3 described in section 4.2 of draft-ietf-hokey-key-mgm-13 as follows:
Scenario 1: 
       EAP/AAA server to USR-KH:  In this scenario, the EAP/AAA
      server delivers a USRK to a USR-KH.
Scenario 3: 
      DSR-KH to DSUSR-KH:  In this scenario, a DSR-KH in a
      specific domain delivers keying material DSUSRK to a DSUSR-KH in the same
      domain.
In both scenarios mentioned above, the USRK or DSUSRK should firstly be delivered to DSR-KH and DSUSR-KH respectively.
Do this clarify?

Regards!
-Qin
----- Original Message ----- 
From: "Sebastien Decugis" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, January 07, 2010 3:32 PM
Subject: Re: [Dime] New version of draft-wu-dime-local-keytran

> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime