Re: [HOKEY] ERX issues

[Yoshihiro Ohba <yohba at tari.toshiba.com>]

Charles,

I would like to note that this is not only my comment, but also there
are couple of comments from others.

[1] Bernard Aboba mentioned
(http://www.ietf.org/mail-archive/web/hokey/current/msg01151.html):

"
What can be done to address the problems?
The most satisfying solution from a security
perspective would be to eliminate the piggybacking
of DSRK provisioning on top of legacy EAP
exchanges.  Providing an explicit request
from the peer to the server for provisioning
of the DSRK would provide the server with
proof of client liveness within the domain
which subsequently will issue accounting
records, closing the fraud loophole, as well as
removing the RFC 4962 "authenicate all
parties" problem, and any security impact
on legacy EAP deployments.

Another potential approach would be to
introduce authorization checks on the
AAA server.  For example, the AAA server
could require that the ERX server be
only one hop away, thereby addressing
the "authenticate the parties" issue.
Also, the ERX server could now be
guaranteed to be in the same domain
as the user, limiting the potential
for fraud to roughly the same magnitude
as existing fast handoff proposals
such as 11r.
"

[2] Chunqiang Li mentioned
(http://www.ietf.org/mail-archive/web/hokey/current/msg01173.html):

"
Yes, and it is not compliant with the requirements in RFC4962 if removing
the KDE1 and KDE4.
"

Regards,
Yoshihiro Ohba

On Sun, Mar 23, 2008 at 09:36:34PM -0400, Charles Clancy wrote:
> Yoshi,
>
> > I strongly believe that peer consent of DSRK, which is eventually used
> > by the peer and visited domain to establish link-layer SAs for all
> > authenticators in the entire visited domain, is important and needed.
>
> I've added your comments to issue 40 in the tracker, but the WG  
> consensus, as measured at IETF 71, is to not implement peer consent for  
> DSRK key distribution.  I understand that you feel strongly about this  
> issue, but in the interest of making progress on our documents, I  
> request that we move on.  Are you willing to make the required changes  
> to the key-mgm document?
>
> --
> t. charles clancy, ph.d.                 eng.umd.edu/~tcc
> electrical & computer engineering, university of maryland
>
_______________________________________________
HOKEY mailing list
HOKEY at ietf.org
https://www.ietf.org/mailman/listinfo/hokey