Subject: [AAA-DOCTORS] Authentication and Authorization for Constrained Environments, new charter proposal

From: Benoit Claise <[email-masked]>
Date: Wed, 14 May 2014 11:52:48 -0700

AAA doctors,

In tomorrow IESG telechat, we will be discussing 
https://datatracker.ietf.org/doc/charter-ietf-ace/00-00/.
Any quick reaction?

Regards, Benoit

---

From: Alan DeKok <[email-masked]>
Date: Wed, 14 May 2014 15:19:32 -0400

> https://datatracker.ietf.org/doc/charter-ietf-ace/00-00/.

  I haven't been following it in detail, but it does seem rather vague.

...
This working group therefore aims to produce a standardized solution for
authentication and authorization to enable authorized access to
resources in constrained environments.
...

  What are "resources?  It seems they are applications, but the charter
doesn't make that clear.  Also, if the "constrained environments" are
using DTLS, they don't seem that constrained to me.

  It looks to be a slight variation on existing technologies.  e.g. we
want X, Y and Z, but in situation B instead of A.  So... we're going to
design something completely new.

  On the other hand, I'm happy to see people paying attention to
authentication and authorization.  Too many protocols are designed to
solve a problem first, and second to add security.

  Alan DeKok.

---

From: Jouni Korhonen <[email-masked]>
Date: Wed, 14 May 2014 22:55:08 +0300

I should have looked at this but managed to neglect all the discussions 
on the list :(

- Jouni

5/14/2014 9:52 PM, Benoit Claise kirjoitti:
> _______________________________________________
> AAA-DOCTORS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/aaa-doctors

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 14 May 2014 13:06:20 -0700

The Charter makes a number of assertions that are provably false, such as that AAA protocols are inappropriate for constrained environments. AAA protocols were deployed in the 1990s to support extremely limited NAS devices and Internet hosts with tiny fractions of the power of today's systems.  Any device that can run IP can authenticate against a AAA server.

Also, the Charter is not clear if the intent is to produce a AAA protocol competing with RADIUS or Diameter.  

> On May 14, 2014, at 12:55 PM, "Jouni Korhonen" <[email-masked]> wrote:
> 
> 
> I should have looked at this but managed to neglect all the discussions on the list :(
> 
> - Jouni
>

---

From: Benoit Claise <[email-masked]>
Date: Wed, 14 May 2014 15:11:34 -0700

Hi Bernard,
> The Charter makes a number of assertions that are provably false, such as that AAA protocols are inappropriate for constrained environments.
Can you point me to the text that makes you believe that.

Anyway, I'll put a block on this new charter, and include the 
aaa-doctors in the copy list.

Regards, Benoit
> AAA protocols were deployed in the 1990s to support extremely limited NAS devices and Internet hosts with tiny fractions of the power of today's systems.  Any device that can run IP can authenticate against a AAA server.
>
> .