Subject: RE: [mobile-ip] Why not IKE? (was: Re: Drafty draft about key es tablishment for Binding Update)

From: "Haseeb Akhtar" <[email-masked]>
Date: Mon, 26 Mar 2001 12:34:16 -0600

Folks,

In addition, the 3GPP has also decided to deploy a AAA protocol 
between the call servers (known as x-CSCF) and the users info
center (termed HSS for Home Subscriber Server). The current
leaning is heavily toward Diameter.

Regards,

Haseeb

-----Original Message-----
From: James Kempf [mailto:[email-masked]]
Sent: Monday, March 26, 2001 12:22 PM
To: [email-masked]
Subject: Re: [mobile-ip] Why not IKE? (was: Re: Drafty draft about key
establishment for Binding Update)

Mike,

> > >Sorry for the confusion. I was summarizing the IESG (and others)
concerns
> > >about using AH for solving the mobile IPv6 security problem.
> > >I did not mean to use the word "scale". Hence, if we don't want to use
AH
> > >and not solve the authorization problem, why can't we just use the IKE
> > >part alone ? If this is also considered heavy weight, all new solutions
> > >should be compared against this. 
> > >
> > 
> > I won't presume to say I can contribute much to the security discussion,
but
> > one concern with IKE is deployment. Some network operators may not
> > want to deploy IKE. Alternative solutions for key distribution (such
> > as AAA) may be more desirable.
>
>
>   Whatever the solution is, it better not rely on
>   AAA exclusively. There is no requirement that AAA
>   be run uniformly. In fact, a pretty large percentage
>   of the devices on the net in the here and now do 
>   not use AAA _at all_. The one I'm typing on right 
>   now is a fine example.
>

I did not say that it should be used exclusively, only that IKE should
not be the only solution due to concerns about widespread
deployment.

With regard to how many devices will use AAA, both
3GPP and 3GPP2 have recently standardized on the IETF AAA architecture
for their all IP core networks. 3GPP2 is in the process of deploying
AAA for mobile IPv4 in their current IOS v4.x with Radius as the protocol,
and in Version C, to be standardized this summer, they intend to
employ Diameter. I believe it is a fair assessment to say that AAA will
likely
be widely deployed in telephony networks in the future. 

Perhaps you have some information about similar deployment plans for IKE
that motivated your statement? If so, perhaps you could share it?

		jak

---

From: Michael Thomas <[email-masked]>
Date: Mon, 26 Mar 2001 11:00:14 -0800 (PST)

> leaning is heavily toward Diameter.

   1) IETF doesn't do architectures

   2) This is pretty much a faithful recreation
      of the PSTN with all of its inherent problems

   3) Public Cellular is not the only user of mobility. 
      In fact, it may very well be fairly far down on
      the list of deployments given the cost and ease
      of other wireless technologies

   4) That 3GPP has decided to use AAA at SIP proxies
      is pretty out there on its own as far as SIP goes.
      The current reality is HTTP basic/digest authentication; I
      place no value judgement on that. In fact, there is no
      standard way in SIP to deliver CHAP-like credentials at all.

   Not that this has anything to do with mobile IP. What does
   have to do with Mobile IP is that it MUST be authentication
   system neutral instead of trying to pick favorites.

		  Mike