Subject: Using AAA for establishing MIPv6 Route Opt. SAs

From: "Karim El-Malki (ERA)" <[email-masked]>
Date: Thu, 15 Feb 2001 16:59:22 +0100

Hello Mike

> First, let me apologize since this is pretty
> off-topic -- I wanted to take this to mobile-ip,
> but Nortel's listserv seems to have completely
> melted down.

So let's move this one over to the Mobile IP list now.

> Karim El-Malki (ERA) writes:
>  > >     Well, first of all the notion that CN has any
>  > >     relationship with a AAA of any sort is highly
>  > >     suspect, IMO. Whose AAA is my apache web
>  > >     server supposed to be contacting?
>  > 
>  > Clearly it doesn't apply to all cases and this was not the 
> purpose of
>  > the draft. On the other hand I expect the AAA infrastructure to be
>  > widespread, it already includes some KDC functionality and 
> therefore
>                                        ^
>                                        |
>                                        tenuous to put it in the most
>                                        charitable terms

Are you saying that AAA cannot generate and distribute keys?
Surely not.

> 
>  > looks pretty good for the purpose of things like SA establishment
>  > for Mobile IP route opt. between mobile devices. My 
> thinking is that
>  > Route opt will be most useful for real-time applications 
> between mobiles
>  > so your apache web server example was not the aim.
> 
>    I don't see why there's any advantage if it means that you
>    have to have a completely different mechanism to deal
>    with servers and interrealm. The moblie node is 
>    then stuck with yet another way to key SA's.

The advantage is that it's a mechanism based on AAA without the
need for other servers or direct MN-CN communication which may
use more wireless resources and require more message exchanges.

> 
>    The entire scheme strikes me as a gigantic hack
>    and yet another misuse of AAA which seems to be
>    giant accretion disk of bad ideas.
> 

You seem to give little technical feedback but then jump to
calling things bad ideas and gigantic hacks. Why?

> 
>  > >     Second, if you want centralized key distribution in 
>  > >     the manner you are describing, Kerberos is a far
>  > >     better fit and has been around forever. Kerberos in
>  > >     general has a lot of very appealing properties for
>  > >     fast mobility and scaling.
>  > > 
>  > 
>  > The mechanism in the draft is different from Kerberos. We try
>  > to eliminate the direct communication between nodes
> 
>    That sounds like a bug not a feature to me.

As above.
   
>    How, for example, do you plan to allow each
>    host to contribute to the keying material
>    entropy? Cipher suite negotiation? Cross
>    realm keying and policy? Oh, and best of all
>    how does MN/CN trust the AAA? Current AAA
>    assumes unidirectional (client->AAA) trust.

I think Pat has already answered this one. The MN must be able
to trust the AAA infrastructure (AAAH).

> 
>  > and only go
>  > through the AAA infrastructure. Also, you seem to be assuming that
>  > Kerberos KDCs will be available everywhere while AAA won't be?
> 
>    AAA certainly will not be used where access
>    control is not needed. Kerberos and distributed
>    PKI's at least have the advantage that they 
>    address security problems common across narrow
>    slices of the problem space.

I can see access control being needed in most places and I
can certainly see Mobile IP using AAA.
Does that solve your issue?

/Karim

---

From: "Karim El-Malki (ERA)" <[email-masked]>
Date: Fri, 16 Feb 2001 13:04:27 +0100

> So then it would be called AAAE?.  

Why? It's just AAA.

> 
> Either it has 100% functionality, or zero.  Would anyone 
> trust their credit
> card numbers to something that was 
> "some what" secure?

Have you read the draft in question?
Please point out where credit cards affect the use of AAA for MIPv6
route opt. SA establishment.

> 
> Is Accounting Mandatory in your AAA?  Are absolutely ruling out
> Bluetooth/802.11 mobiles using Mobile IP?

I can't understand what you mean.
We're using the AAA for MIPv6 SA establishment independent of L2 technology.
Clearly the assumption is that you use AAA and trust your AAAH. Of course
this
draft wasn't meant to solve things if you don't use AAA.

/Karim