Hi,
El 05/07/11 22:18, Josh Howlett escribió:
>
> Steps 4-6. I think it would be useful to explain why the RP is using an
> identity to "contact" the trust routers in the consecutive realms. It
> might not be obvious to the reader that the RP is building a transitive
> chain of trust by walking the trust path. I suggest explaining this right
> at the start of section 1.1.
>
> Obviously an understanding of KNP is an essential part of this. I wonder
> if it's worth including some discussion of KNP. On a more general note,
> what is your opinion as to how this draft and KNP inter-relate - should
> they remain distinct documents, or be combined somehow?
>
A few comments:
Section 1:
- I think this document should include, in section 1 or in a motivation
section, a clear text of why it is necessary this multihop
infrastructure. I mean, What is the target problem or use-case to be
solved? For people who has not read before this idea is very difficult
to catch the motivation.
- It is not clear what the Trust Router is. Advanced production routers
running in institutions? or Is it a new entity every institution should
deploy?
- Does the term Trust Path refer to the AAA path/TRs path/mixed?
Section 1.1.
- I think the RADIUS or RadSec server should be included in the diagram
(even if it is co-located with the idP)
- " 4. The Relying Party contacts a trust router in Realm B (using its
permanent identity in Realm A)"
So Trust Router in realm B should "delegate" the authentication of
RP to realm A, an so on ....?
Section 1.2
Does the term Trust Router Protocol refer to a "secure" routing
protocol?
Section 4:
- The list of security properties required by the Trust Routers
would help to a better understanding of the protocol :)
Sections 5 and 6:
- Do you have in mind some transport and communication protocols for the
Trust Path Query and Temporaly Identity Request? I understand this
document describes the general idea, the questions are just to know if
you have in mind some answers already thought.
Why does the RP ask every router in the federation? I mean, if
requesting TR A, which by means of some "advanced" routing protocol is
able to know the better path from A to D, after the first request the RP
knows TR D or even idP.
Section 6.
"When a Temporary Identity is requested, a Trust Router
will provision a new identity in its local RADIUS infrastructure that
can be used by the Relying Party to communicate with the Trust Router
or RADIUS/RADSEC server that represents the next step in the Trust
Path."
Then, every institution hosts a TR and a Radius/RadSec server, this
should be clarified in the diagram and the introduction.
It is not clear for me the relationship between Trust Path Queries and
Temporaly Identity Requests. When are they sent from the RP to the TR?
What is the global number of message exchanged between RP, TRs, RADIUs,
etc..?
Sorry, maybe these are fool questions, as said before, I understand this
is the general idea, I just try to understand it :)
Thanks in advance and regards, Gabi.
--
----------------------------------------------------------------
Gabriel López Millán
Departamento de Ingeniería de la Información y las Comunicaciones
University of Murcia
Spain
Tel: +34 868888504
Fax: +34 868884151
email: [log in to unmask]
|