Subject: [MEXT] Fwd: [Dime] MIP6 RADIUS and Diameter MIPv6 Split Draft

From: "Vijay Devarapalli" <[email-masked]>
Date: Tue, 19 Aug 2008 07:47:04 -0700

FYI.

Please respond on the DIME mailing list or directly to Hannes.

We discussed the RADIUS MIP6 draft in the MEXT meeting in Dublin.

Vijay

---------- Forwarded message ----------
From: Hannes Tschofenig <[email-masked]>
Date: Sun, Aug 17, 2008 at 11:32 AM
Subject: [Dime] MIP6 RADIUS and Diameter MIPv6 Split Draft
To: [email-masked]

Hi all,

Avi gave a presentation about the MIP6 RADIUS draft
http://www3.ietf.org/proceedings/08jul/slides/mext-9.ppt
and the MIP6 RADIUS draft
http://www.ietf.org/internet-drafts/draft-ietf-mip6-radius-05.txt
is the RADIUS counterpart of our Diameter Mobility documents:
http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-10.txt and
http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-integrated-09.txt

Now, here is the important part.

As part of the work on the draft, the feedback Avi got during the
presentation and offlist comments from Pasi and Jari there are some
concerns about the security properties provided by the following two
mechanisms:
* IKEv2 with PSKs
* IKEv2 with CERTs

To briefly summarize the problems (also described in the slide set)
there are the following issues:
* Having the AAA deliver a PSK key to the HA without the AAA
performing authentication introduces security vulnerabilities. The
discussed possible solutions where the AAA could authenticate the PSK
are somewhat "clunky" since IKEv2 was never meant to be used in such a
way.
*  Similar problems arise with IKEv2 and Certificates where the AAA
server is used to just authorize without getting involved in the
authentication procedure itself.

In an offline discussion between Jari, Pasi, Avi, and Jouni the idea
came up to drop these two mechanisms from the MIP6 RADIUS document and
consequently also from the Diameter MIPv6 Split draft.

Is this a bad thing?

I don't think so. Currently, we don't know anyone who would be using
them. Hence, there are somewhat "theoretical" at the moment.

We could specify them once deployments would be asking for them.

Who has objections against dropping the above-described mechanisms
from the  Diameter MIPv6 Split draft?

Ciao
Hannes

_______________________________________________
DiME mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dime
_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext