Subject: [NSIS] authorization

From: Tschofenig Hannes <[email-masked]>
Date: Wed, 9 Jul 2003 17:23:56 +0200

hi melinda, 

since you are raising the authorization discussion i would like to make
things a little bit more precise:

- which entities would you like to see involved in computing the
authorization decision?
- how long do you think is the authorization decision valid? (e.g.
authorization decision only for a single request)
- what information is needed to compute the authorization decision? (e.g.
price, qos objects, etc.)

do you think that the authorization decision along (together possible with
entity authentication) is sufficient i.e. that there is no need for
signaling message protection? 

ciao
hannes

> -----Original Message-----
> From: Melinda Shore [mailto:[email-masked]]
> Sent: Wednesday, July 09, 2003 2:08 PM
> To: Michael Thomas
> Cc: [email-masked]
> Subject: Re: [NSIS] Short Review of draft-shore-ntlp-00.txt 
> 
> 
> > So if I had to choose whether to put a bunch of
> > effort making hop-by-hop auth/conf/authz better or
> > hop-to-decision-maker architectures better, I'd
> > choose the later. 
> 
> I think the latter obviously needs more attention in
> general, but when you slice apart the NSIS layers it becomes
> pretty clear that you need to focus on the hop-by-hop
> problem in the NTLP context or you end up doing things that
> aren't that meaningful for actually protecting the traffic
> or you end up overly constraining, I think, the design.  For
> example, doing something like source authentication almost
> certainly doesn't make sense when you're providing a
> generalized mechanism for bundling NSLP payloads.
> 
> It seems pretty clear to me that the NTLP security problem
> is hop-by-hop and the NSLP problem, depending on the
> application, will tend to be what you call "hop-to-decision-
> maker."
> 
> Melinda
> 
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Melinda Shore <[email-masked]>
Date: Wed, 09 Jul 2003 12:15:58 -0400

> signaling message protection? 

I think that if you asked me today (which you did), I
wouldn't do any authorization at the NTLP layer.  I'm not
sure if it's meaningful.  It seems to me that the questions
that would be asked are either "may I send you a packet?"
and/or "may I send you an NSLP payload?," neither of which,
I think, would be or even could be properly answered by
NTLP.  It wouldn't be very difficult to convince me to
change my mind on this, but right now it seems that it's the
wrong question for NTLP.

Melinda