Subject: RE: multiple devices or multiple users ?

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 7 Jan 2002 16:21:00 +0100

I'm not going to argue for changing the charter ...again !
Apparently the distinction between user and device
authentication was removed, I was off the list back then
and didn't get a chance to express my opinion. But 
for the record, I disagree. Reasons are below.

  > I do not think the distinction between users and devices in 
  > the context of
  > PANA is useful. 

=> Let me answer you by asking this question: Why does 
and ISP want to run AAA? IMHO for 2 reasons:

- Making sure USERS will pay. Devices don't have bank
accounts :)

- Making sure Bad Guys stay out of the network, by 
identifying them during the authentication process. 
Again Bad Devices do not exist...Bad People do !

  > 
  > Authentication/security protocols tend to run between 
  > *elements* that
  > identify themselves according to the requirements of the protocol in
  > question. Users, devices, IP stacks are all *elements* that 
  > can use a given
  > security protocol. Think of IPSEC. Does IPSEC run between 
  > devices or between
  > users? 

=> Devices.

Does it mater? 

=> YES !

Isn't that an implementation detail 

=> Absolutely not. Think of a GSM phone. If I give you
my phone (only the device not the SIM card) and 
you start using it with your SIM card, will the operator
still think it's me using the phone ? 
Who does the operator authenticate now ? The SIM card 
is a _subscriber_ identifier. The operator couldn't care
less about the device you're using.

What is an implementation issue, however, is how you
represent this user identity: pice of plastic, password, 
....etc

  > and a function of
  > who or what *element* owns the keys? 
Why should PANA be different? 

=> Again response by asking a question: SIP manages USER mobility, 
why should MIP be different ?? 
Do you see why this logic is not right ? They_do_different_ 
things.

Cheers,
Hesham 

PS: As IU said I will not argue for the charter 
change of course, but this lack of distinction
makes no sense to me.

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 7 Jan 2002 11:45:22 -0500

My understanding is as follows.

Basically, the user is authentciated.  However, when we are talking
about the protocol entity used for PANA, we can also say that the
device is authenticated on behalf of the user,

Yoshihiro Ohba