Re: [HOKEY] ERX issues

[Rafa Marin Lopez <rafa at um.es>]

Hi Charles,

For those we could not attend the IETF 71 (like me), could you summarize 
the technical reasons why the peer consent for DSRK key distribution 
should be removed?

At first sight, I see more security problems when peer consent is NOT 
implemented and some of them have been already mentioned. However, i see 
real benefits on providing peer consent to assure the server distributed 
a DSRK only when it was really required by the peer.

Based on this,  i would like to understand the technical reasons to NOT 
implement peer consent.

My best regards.



Charles Clancy wrote:
> Yoshi,
>
>  > I strongly believe that peer consent of DSRK, which is eventually used
>  > by the peer and visited domain to establish link-layer SAs for all
>  > authenticators in the entire visited domain, is important and needed.
>
> I've added your comments to issue 40 in the tracker, but the WG 
> consensus, as measured at IETF 71, is to not implement peer consent for 
> DSRK key distribution.  I understand that you feel strongly about this 
> issue, but in the interest of making progress on our documents, I 
> request that we move on.  Are you willing to make the required changes 
> to the key-mgm document?
>
> --
> t. charles clancy, ph.d.                 eng.umd.edu/~tcc
> electrical & computer engineering, university of maryland
> _______________________________________________
> HOKEY mailing list
> HOKEY at ietf.org
> https://www.ietf.org/mailman/listinfo/hokey
>
>   


-- 
------------------------------------------------------
Rafael Marin Lopez
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34968398501    e-mail: rafa at um.es
------------------------------------------------------

_______________________________________________
HOKEY mailing list
HOKEY at ietf.org
https://www.ietf.org/mailman/listinfo/hokey