Subject: RE: Security stuff was RE: Comments Re: [seamoby] ct problem stat ement

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 5 Jun 2001 17:55:43 +0200

# hi mark!

What good is authorization without authentication?

oldAR: "Yeah, this guy is authorized."
newAR: "Really?  Who is he?"
oldAR: "Uh, he's, well, authorized."
newAR: "I don't buy it."

Maybe I'm just paranoid, but I'd like to suggest that authentication and
authorization go hand-in-hand.

# authorization and authentication do not always go hand-in-hand:
# an example: 
# if you look at the proposals for the mn-cn binding update problem you 
# will see that they all do not provide authentication but most of them
# try to solve the address ownership problem - an authorization 
# problem. 

# but in most cases you are right. 

-Mark
# ciao
# hannes tschofenig

---

From: Michael Thomas <[email-masked]>
Date: Tue, 5 Jun 2001 09:54:02 -0700 (PDT)

> # but in most cases you are right. 

I really don't think that mipv6 address ownership
problem is the best example. In fact, the
proposals that have been submitted all assert
identity, namely the IP address from whence they
came. Most (all?) of the proposals for the CN
problem depend on a return routability check as
both a check on authentication -- CN challenges,
MN responds to the challenge with the same IP
address -- and authorization -- if the MN can
respond at all, it must have been authorized by
its attachment point, and so on through the
network.

Note that this is a weak form of both
authentication and authorization (ie no strong
crypto binding), but it does try to accomplish
both goals.

	Mike