RE: [HOKEY] consensus call: ERX transport

Hi Dan, 

> -----Original Message-----
> From: Dan Harkins [mailto:dharkins@lounge.org] 
> Sent: Wednesday, July 25, 2007 9:05 AM
> To: Narayanan, Vidya
> Cc: Yoshihiro Ohba; Tim Polk; hokey@ietf.org
> Subject: RE: [HOKEY] consensus call: ERX transport
> 
> 
>   Hi Vidya,
> 
> On Wed, July 25, 2007 8:20 am, Narayanan, Vidya wrote:
> > All,
> > A couple of clarifications:
> >
> > - The current notes on the authenticator state machine 
> describe how to 
> > transition from the EAP to ERX state machine.
> 
> A transition between state machines? It's an EAP packet. It's 
> being received by the EAP layer. It's being processed by a 
> chunk of EAP code.
> The state machine to handle requires a change.
> 

I guess it depends on how it is implemented.  In any case, it is a new
chunk of state machine which is hooked on to the existing state machine.
It is that "hook" that is described in the current text. 

> >                                                If there is no 
> > transition, the EAP state machine can time out, but, I believe that 
> > would not be ideal.
> 
> No, that would not be ideal. Which brings up a question that 
> has been nagging me for a while. How is a peer to know 
> whether the server is HOKEY-enabled or not? It could respond 
> to the ID request with this new ERX packet which the 
> authenticator will...well, I guess drop on the floor. Then is 
> the peer just supposed to wait some period of time before 
> assuming that a fast handover is just not gonna happen and 
> had he just responded with his identity he'd be authenticated by now.
> 

Did you mean server isn't HOKEY-enabled or authenticator isn't
HOKEY-enabled or both?  In some lower layers, the ERX support will be
indicated by the lower layer and hence the peer will know about that.
In case the peer has no idea of whether the server supports ERX, it can
do an ERP bootstrapping exchange without waiting for a handoff (i.e.,
after finishing regular EAP through an authenticator) - it will not get
a response and can conclude that ERP isn't feasible. 

With the proposed change of having an ERP-specific initiation message
from authenticator, it will be clearer, since the authenticator will
only send the EAP Initiate/Re-auth-Start message if it supported ERP.
If it only sent EAP Request/ID, it doesn't indicate support for ERP. 

Vidya

> Doesn't this require a giant flag day for deployment?
> 
>   Dan.
> 
> 
> 
> 

_______________________________________________
HOKEY mailing list
HOKEY@ietf.org
https://www1.ietf.org/mailman/listinfo/hokey