Subject: RE: [mobile-ip] Concerns/comments for aaa-keys and gen-key

From: "Faccin Stefano (NRC/Dallas)" <[email-masked]>
Date: Wed, 26 Sep 2001 20:08:09 -0500

Hello Alex,

please find some comments/answers below.

Stefano

> -----Original Message-----
> From: ext Alexandru Petrescu [mailto:[email-masked]]
> Sent: Wednesday, September 26, 2001 7:57 AM
> To: Fredrik Johansson
> Cc: [email-masked]; [email-masked]
> Subject: Re: [mobile-ip] Concerns/comments for aaa-keys and gen-key
> 
> 
> Hi Frederik,
> 
> Since this has been brought up, I have a few questions that I wanted
> to ask a while back.  See inline, thanks.
> 
> Erik:
> > >> 4. Between the lines there appear to be some architectural
> > >> assumptions e.g. that AAAh and HA have some high degree of mutual
> > >> trust, which seem to imply that the solution might not be a good
> > >> fit when the AAAh and HA are operated by different entities.
> 
> Frederik:
> > The assumption is that a AAA server (let it be AAAh or 
> AAAf) have a high
> > degree of mutual trust with the HA. And that AAA servers of 
> different
> > domains have a mutual trust (Service Level Agreement).
> 
> It looks to me that an (AAAH, HA) must have SLA's with every AAAF's in
> whose domains that HA's MN could possibly roam.  Doesn't this boil
> down to a scaleability issue similar to Mobile IPv6 (in which MN must
> have trust relationships with any possible CN)?

In the current drafts there is no assumption regarding a trusted
relation between AAAF and the HA in the home domain of the MN. The
drafts allow for dynamic allocation of a HA in a foreign domain, thus
the security relation assumed in the draft is between AAAFs and HAs
belonging to the same domain.

In the drafts it is assumed that AAAH and AAAF have a trusted relation
in the sense that it is possible to safely exchange information between
AAAH and AAAF. How this is achieved is another matter. A simple way to
do it would be to have an SA between AAAF and AAAH, but as you say this
can lead to scalability issues. However, the concept of "security
gateway" can be used, where entity in the foreign/home domain share a
local SAf/SAh with security gateways, and security gateways belonging to
visited and home domain share another SA (e.g. established as result of
roaming agreements or through other mechanisms). In such way, AAAF can
send messages protecting them with SAf, the security gateways transmits
it to the home domain using SA, and the gateway in the home network uses
SAh to protect the message to AAAH. In this way scalability can be
achieved, as already demonstrated in other large scale commercial
networks using similar concepts.  

Finally, the issue is quite different from the security issue with
Mobile IPv6. In Mobile IPv6 it wouldn't be very "clean" to use security
gateways, since we would break the end-to-end nature of Binding Updates.
Int he AAA case we just want to make sure that messages exchanged, e.g,
between AAAF and AAAH are protected (mainly integrity protection and
data authentication), but there isn't really an end-to-end issue.

> 
> I can understand trust between AAAH and HA, but I suppose that trust
> relationship between AAAH and AAAF's, or between HA's and AAAF's, are
> difficult.  If I'm missing something, sorry, please enlighten me.
> 
> If one can assume trust between an HA and any AAAF then why not using
> same method between MN and CN?
> 
> Alex
>

---

From: Alexandru Petrescu <[email-masked]>
Date: 27 Sep 2001 16:03:09 +0200

Stefano, thank you for your reply.  

"Faccin Stefano (NRC/Dallas)" <[email-masked]> writes:
> However, the concept of "security gateway" can be used, where entity
> in the foreign/home domain share a local SAf/SAh with security
> gateways, and security gateways belonging to visited and home domain
> share another SA (e.g. established as result of roaming agreements
> or through other mechanisms).

Where can I find more about this "security gateway" concept?  Is it a
recent IETF IPsec thing?  Or does it stem from the earlier firewall
research originated by Steve Bellovin?

So all security gateways of all domains have SA's among them.  You
mention "roaming agreements".  You previously mentioned SLA's.  You
reduce the AAAF-AAAH trust problem to SecGate-SecGate trust problem.
I suppose the problem is still there.

> In such way, AAAF can send messages protecting them with SAf, the
> security gateways transmits it to the home domain using SA, and the
> gateway in the home network uses SAh to protect the message to
> AAAH. In this way scalability can be achieved, as already
> demonstrated in other large scale commercial networks using similar
> concepts.

For my better understanding: examples of those successful comercial
networks, please?  Were they using IETF protocols?

Thank you,

Alex