Subject: RE: [NSIS] authorization

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 10 Jul 2003 10:44:52 +0200

hi 

i should mention that we should not only focus on the first/last peer
communication (we we actually have a user). there this classical
authentication, authorization (+ key exchange) example is found.
authorization within other places (such as inter-domain, intra-domain, etc.)
looks different and does not require a aaa infrastructure. there are
certainly different security requirements between these parts in the
end-to-end signaling path.

ciao
hannes

> -----Original Message-----
> From: Tschofenig Hannes 
> Sent: Thursday, July 10, 2003 10:33 AM
> To: [email-masked]'; [email-masked]
> Cc: [email-masked]
> Subject: RE: [NSIS] authorization 
> 
> 
> hi john, 
> 
> that adds some light to our discussion. 
> 
> > Hi Hannes,
> > 
> > What I think we need to discuss & decide upon are the following:
> > 
> > 1) Security & robustness to DoS attacks at both the NTLP & 
> > NSLP layers.
> > 2) Authentication & Authorization issues for services.  
> 
> that's goes along with my observation. 
>  
> > My gut feeling is that the AA issues would be most 
> > appropriate to handle
> > at the NSLP layer.
> 
> some of the question we raised with NSIS AAA
> (draft-tschofenig-nsis-aaa-issues-01.txt) and with QoS NSLP 
> Authorization
> Issues (draft-tschofenig-nsis-qos-authz-issues-00.txt) 
> address this issue.
> it is certainly necessary to get some conclusion since it has 
> an impact on
> the nslp protocol design. for the nat/firewall handling other 
> authorization
> decisions are important as described in  
> draft-brunner-nsis-midcom-ps-00.txt
> 
> small note: authorization does not necessarily need to be 
> combined with
> authentication (and also not necessarily at the same layer).
>  
> > 
> > Does this make sense?
> yes. 
> 
> ciao
> hannes
> 
> > John
> > 
> > > -----Original Message-----
> > > From: ext Tschofenig Hannes [mailto:[email-masked]]
> > > Sent: 10 July, 2003 11:21
> > > To: Loughney John (NRC/Helsinki); [email-masked]
> > > Cc: [email-masked]
> > > Subject: RE: [NSIS] authorization 
> > > 
> > > 
> > > hi john, 
> > > 
> > > i somehow got lost in this discussion. 
> > > 
> > > what is the question that should be answered? 
> > > 
> > > - is it about at which layer signaling message protection 
> > > should take place?
> > > 
> > > 
> > > - is it about authorization?
> > > if so then we have to further differentiate between 
> > different messages and
> > > different locations along the end to end path. i also have 
> > to agree that
> > > certain authorization decisions make only sense at the nslp 
> > (and at a
> > > particular context). 
> > > 
> > > ciao
> > > hannes
> > > 
> > > btw, the aaa context could be somewhat misleading here 
> since the aaa
> > > protocol runs between the aaa server and the attendant 
> > whereas the nsis part
> > > would be between the client and the attendant.
> > > that's also the reason why the nsis working group does not 
> > really deal with
> > > aaa protocols or extensions. an nsis protocol therefore 
> > only serves as a
> > > "information provider" for a subsequent aaa interaction (as 
> > proposed in the
> > > past already).
> > > 
> > > > -----Original Message-----
> > > > From: [email-masked] [mailto:[email-masked]]
> > > > Sent: Thursday, July 10, 2003 5:24 AM
> > > > To: [email-masked]; Tschofenig Hannes
> > > > Cc: [email-masked]
> > > > Subject: RE: [NSIS] authorization 
> > > > 
> > > > 
> > > > Hi Melinda,
> > > > 
> > > > > I think that if you asked me today (which you did), I
> > > > > wouldn't do any authorization at the NTLP layer.  I'm not
> > > > > sure if it's meaningful.  It seems to me that the questions
> > > > > that would be asked are either "may I send you a packet?"
> > > > > and/or "may I send you an NSLP payload?," neither of which,
> > > > > I think, would be or even could be properly answered by
> > > > > NTLP.  It wouldn't be very difficult to convince me to
> > > > > change my mind on this, but right now it seems that it's the
> > > > > wrong question for NTLP.
> > > > 
> > > > That makes sense, for example, for AAA services, the transport
> > > > protocol is not authorized; it is the AAA protocol (RADIUS,
> > > > Diameter) where the authorization takes place.
> > > > 
> > > > John
> > > > 
> > > 
> > 
> 
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis