Re: [HOKEY] Comments on draft-ietf-hokey-preauth-ps-02

[Yoshihiro Ohba <yohba at tari.toshiba.com>]

Glen,

Thank you for the review.

On Thu, Apr 17, 2008 at 02:26:46AM -0700, Glen Zorn wrote:
> Editorial:
> Section 1 should be Section 8, just before "Acknowledgements"
> 
> Lots of grammatical errors.

Charles has the same editorial comments and we will address them 
in the next revision.

> 
> 
> Technical:
> A better exposition upon the trust relationships involved is required, I
> think.  For example, it's not clear to me how indirect pre-auth could
> work w/o a pre-existing trust relationship between the SA & CA.

Yes, some trust relationship will be required between serving network
and target network for indirect pre-authentication.  We will add text
on the trust relationships.

> 
> Just a couple of general questions about feasibility: Do we actually
> expect service providers to provision (let alone advertise) globally
> routable IP addresses in all their NASs?  Similarly, is it actually
> reasonable to expect all of one service provider's NASs to share trust
> relationships with all of another SP's NASs?
> 

For the first point, globally routable IP address may not be needed
for target authenticators in the case of indirect pre-authentication
and intra-domain direct pre-authentication.  We will revise Section
5.1 accordingly.

For the second point, I think that trust relationship among individual
authenticators may not be not needed.  Trust relationship among
neighboring domains may be sufficient.  A TA can perform reverse DNS
lookup to check if the SA has a domain name of a trusted domain.

Best Regards,
Yoshihiro Ohba

_______________________________________________
HOKEY mailing list
HOKEY at ietf.org
https://www.ietf.org/mailman/listinfo/hokey