Subject: RE: [NSIS] authorization

From: [email-masked]
Date: Thu, 10 Jul 2003 11:23:18 +0300

Hi Hannes,

What I think we need to discuss & decide upon are the following:

1) Security & robustness to DoS attacks at both the NTLP & NSLP layers.
2) Authentication & Authorization issues for services.  

My gut feeling is that the AA issues would be most appropriate to handle
at the NSLP layer.

Does this make sense?
John

> -----Original Message-----
> From: ext Tschofenig Hannes [mailto:[email-masked]]
> Sent: 10 July, 2003 11:21
> To: Loughney John (NRC/Helsinki); [email-masked]
> Cc: [email-masked]
> Subject: RE: [NSIS] authorization 
> 
> 
> hi john, 
> 
> i somehow got lost in this discussion. 
> 
> what is the question that should be answered? 
> 
> - is it about at which layer signaling message protection 
> should take place?
> 
> 
> - is it about authorization?
> if so then we have to further differentiate between different messages and
> different locations along the end to end path. i also have to agree that
> certain authorization decisions make only sense at the nslp (and at a
> particular context). 
> 
> ciao
> hannes
> 
> btw, the aaa context could be somewhat misleading here since the aaa
> protocol runs between the aaa server and the attendant whereas the nsis part
> would be between the client and the attendant.
> that's also the reason why the nsis working group does not really deal with
> aaa protocols or extensions. an nsis protocol therefore only serves as a
> "information provider" for a subsequent aaa interaction (as proposed in the
> past already).
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]
> > Sent: Thursday, July 10, 2003 5:24 AM
> > To: [email-masked]; Tschofenig Hannes
> > Cc: [email-masked]
> > Subject: RE: [NSIS] authorization 
> > 
> > 
> > Hi Melinda,
> > 
> > > I think that if you asked me today (which you did), I
> > > wouldn't do any authorization at the NTLP layer.  I'm not
> > > sure if it's meaningful.  It seems to me that the questions
> > > that would be asked are either "may I send you a packet?"
> > > and/or "may I send you an NSLP payload?," neither of which,
> > > I think, would be or even could be properly answered by
> > > NTLP.  It wouldn't be very difficult to convince me to
> > > change my mind on this, but right now it seems that it's the
> > > wrong question for NTLP.
> > 
> > That makes sense, for example, for AAA services, the transport
> > protocol is not authorized; it is the AAA protocol (RADIUS,
> > Diameter) where the authorization takes place.
> > 
> > John
> > 
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis