Subject: Change [issue13] Mutual authentication requirement

From: <[email-masked]>
Date: Mon, 19 May 2003 10:42:08 +0300

Dan Forsberg <[email-masked]> added the comment:

Changed document.

----------
document: draft-ietf-pana-requirements-xx.txt -> draft-ietf-pana-threats-eval-xx.txt
________________________________________________
PANA Issues <[email-masked]>
http://danforsberg.info:8080/pana-issues/issue13
________________________________________________

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 19 May 2003 10:23:43 -0700

Dan,

I think the requirement in the threats draft states that the PANA
protocol should be capable of mutually authenticating PaC and PAA. The
backend
communication is not directly part of PANA protocol. If there are
vulnerabilities
in the PAA-AS path, go fix the protocol responsible for that. I am still
not
clear on what the issue is.

See draft-aboba-pppext-key-problem-06.txt section 4.2

AAA protocols suitable for use in transporting EAP MUST provide the
following facilities:

Mutual authentication
     AAA protocols used for transport of EAP MUST support mutual
     authentication between the authenticator and backend authentication
     server. These requirements are met by Diameter EAP [DiamEAP] as
     well as by RADIUS [RFC2865].

Are you concerned that there would be a different one in the future
that won't satisfy this criteria ?  

-mohan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> Sent: Monday, May 19, 2003 12:42 AM
> To: [email-masked]
> Subject: Change [issue13] Mutual authentication requirement

> http://danforsberg.info:8080/pana-> issues/issue13
>

---

From: <[email-masked]>
Date: Tue, 20 May 2003 10:09:14 +0300

Mohan,

Thank you for your reference. Maybe a comment about the role 
of PAA-AS SA in this mutual authentication requirement would be
good, because when we say PANA protocol, the scope is between
PaC and PAA. I found the comment about SA between AS and PAA in 
the document, so I guess this is nifty picking. I'll reject 
this issue.

- Dan

> From: ext Mohan Parthasarathy [mailto:[email-masked]]
> Sent: 19 May, 2003 20:24
> To: Forsberg Dan (NRC/Helsinki); [email-masked]
> Subject: RE: Change [issue13] Mutual authentication requirement
> 
> 
> Dan,
>