Subject: [AAA-WG]: Interim Meeting: Summary of changes

From: Patrice Calhoun <[email-masked]>
Date: Thu, 8 Feb 2001 09:09:00 -0800 (PST)

All,

Yesterday we had a very successful and productive Interim meeting, and came
away with the following changes:

1. Base spec must state that only one persistent connection is used between
two 
   peers.
2. Authentication/Authorization messages MUST include an a maximum wait time
that 
   the NAS is willing to wait. If a server determines that a request will take 
   longer to complete, a status message is returned to the NAS. 3. The base
spec will include text on load balancing across multiple proxies, and
   will document Pearson's hash, and use the NAI as the seed. The hash
algorithm
   can be found in draft-ietf-dhc-loadb-03.txt.
4. The Watchdog is back in the protocol. The watchdog is sent when a
connection 
   with a peer is IDLE. This proactive message is intended to determine
whether 
   connectivity with a peer is still available. The protocol will specify a
   time of 3 seconds, but will recommend that it be adaptive if the 
   implementation that retrieve information from the transport (e.g.
Connection 
   Manager). This message is not sent if requests are pending. since the
Device-
   Status-Ind (see below) would be used to communicate errors.
5. The DIAMETER header includes an Identifier field, but it's value MAY change
at
   each hop. Therefore, a server has no way to detect duplicate messages,
since 
   the same message MAY be received from multiple downstream proxies. A e2e 
   message identifier (that does NOT change en-route) is needed.
6. A new non-proxiable message is needed, called the Device-Status-Ind. This 
   message is used by Diameter proxies to send errors to other proxies. Errors
   such as "I'm busy", "Cannot reach the requested domain", and others must be 
   handled by proxies, and not necessarily the NAS (unless the proxy has no 
   recourse). This means that the MRI will be better documented to only handle 
   a smaller number of errors. 7. In order to support #6 above, a proxy now
MUST cache all pending request and
   query messages. New text will be needed to make this clear. I think that the
   whole failover text needs to be moved to a separate section. 8. On the NAS
(and FA) TCP is a MUST, and a note will be added stating that
   future versions of the spec MAY require SCTP as well. Servers MUST support 
   both TCP AND SCTP.
9. The ICV and the Encrypted-Payload are gone. Transmission level security is
   achieved via SSL and IPSec. NAS (and FA) MUST do IP Security, Proxies and
   Home Servers MUST support both SSL and IPSec.
10. Object Security MUST be supported by NASes (and FA) as well as Home
Servers,  
    but not proxies.
11. A new set of messages will be needed, to exchange Security policies. When
a 
    NAS communicates with a new domain, it issues a request and receives a 
    response. The request/response MAY be used to exchange keying information, 
    and MAY require multiple round trips (depending upon the e2e solution
used). 
    Furthermore, the home MAY add additional security policies in the
response. I 
    am not sure where this message belongs (either in the base spec, or a 
    separate spec), but it was determined that e2e was mandatory from the 
    beginning, so the base spec cannot move along until this spec is completed.
12. The Destionation-NAI is used in both directions. Currently, the base spec 
    only requires it for server initiated transactions to the NAS. However,
there 
    are certain instances where multiple round trips MAY be required (e.g.
EAP) 
    and it is necessary for the same home server to be used. Furthermore, when 
    e2e is used, and a symmetric key is exchanged, it is imperative that the
same 
    server be used. Yes, this will NOT allow failover procedures to occur, but
if 
    an error is received stating that a server cannot be reached, the
transaction 
    can be restarted.
13. Conflicting Result-Codes MUST be handled, since it is likely to occur when 
    e2e security is used (the initial successful Result-Code needs to be 
    overwritten by a failure by an intermediate proxy, but the proxy cannot
just 
    change the value of the Result-Code, since it would break e2e, and
therefore 
    must add an additional Result-Code AVP).
14. A Diameter node SHOULD periodically attempt to connect to peers that are
in 
    the IDLE state. A default, reasonable, timer must be provided. Race 
    conditions must be handled, and documented (perhaps an election process?)

Somehow, all these changes will be included in the next version of the
protocol, due prior to the IETF deadline.

Thanks,

PatC

---

From: David Frascone <[email-masked]>
Date: Thu, 8 Feb 2001 11:43:02 -0600

First of all, I want to commend the attendees of the interim meeting.  They
got an incredible amount of work done!  But, I have some comments below about
one of their decisions.

>     beginning, so the base spec cannot move along until this spec is completed.

I have to say I disagree with the new approach to security.  I don't mind the
ipsec/SSL between proxies, but the "beauty" of RADIUS was that it was very
simple to implement, and did not add much network traffic.  Also, RADIUS
take many resources to run, which was good since NASs had low memory and
slow CPUs.

I think that if we require IKE/IPSEC and/or SSL at the NAS level, then we are
losing all of the benefit that RADIUS had.

In my opinion, we were supposed to "improve" over RADIUS, and I don't consider
this change an "improvement".

Just my $.02 worth,

--Dave

---

From: "Jari Arkko" <[email-masked]>
Date: Thu, 8 Feb 2001 21:54:30 +0200

David Frascone wrote

> losing all of the benefit that RADIUS had.

Well, most OSes today have native IPsec. In fact, many NAS boxes seem to have
IPsec since they tend to want to support L2TP security. SSL libraries can be easily
obtained. The same stuff can, and is, used to protect many things. Plus not just
integrity but also encryption can be provided.

Also, we could actually specify MUST IPsec ESP and MAY IKE in order to
make things easier for NASes.

Jari