Subject: RE: [mobile-ip] BU Authorization method: design team recommendation

From: [email-masked]
Date: Mon, 11 Feb 2002 14:10:29 -0600

> (*) RR + CGA is more secure since the AAA servers
> will not know the keys. 

If you use the AAA servers just to authenticate the Diffie Hellman values, the AAA servers will not have knowledge of the keys neither; so I don't think RR+CGA is more secure.

In addition, using AAA servers for key distribution avoids the use of signatures.

Franck

---

From: "Jari Arkko" <[email-masked]>
Date: Mon, 11 Feb 2002 22:27:05 +0200

> If you use the AAA servers just to authenticate the Diffie Hellman values, the AAA servers will not have
> knowledge of the keys neither; so I don't think RR+CGA is more secure.
>

I think the original point about 'more secure' wasn't quite correctly
formulated. The point about CGA is that it is more secure because
it proves address and key relationship, and does so without any sort of
configuration or trust that could go wrong. 

The point about using AAA for key distribution is a correct one:
this probably does avoid the use of signatures. However, we can't
use AAA in isolation, it always needs to be complemented with
the Authentication part --- and that may involve different kinds of
cryptographic operations. True, those don't necessarily have to
be based on signatures. But there has to be something. And it
has to be done to the *CN* also, and this might not have been
necessary otherwise.

I'm very much in favor of the AAA schemes for building infrastructure
to allow access or authenticate a particular service. However, I'm
concerned that its application for MIPv6 Route Optimization would
create a situation where an extremely large global infrastructure would
have to be built. Much larger than would be necessary to e.g. just
authenticate everyone on a cellular terminal - and even that is big
enough. More seriously, everyone outside this global infrastructure
would not get the same kind of service as the ones inside. For instance,
my home web server might not be able to offer Route Optimization
while the operator owned commercial service could. I think this would
be bad for MIPv6, and bad for Internet in general if we could have
avoided it. Finally, as Erik pointed out all of the infrastructure-based
methods have serious trouble with dynamically changing things such
as RFC 3041.

Jari