Subject: Re: (radius) Comments on Tunnel Draft

From: Barney Wolff <[email-masked]>
Date: Fri, 10 Dec 1999 14:30 EST

If the NAS and server knew about each other and shared a secret, there
would be no need for proxies.  But in the normal proxy case, they don't,
so there is no easy way to encrypt Tunnel-Password or User-Password
server-to-NAS.

However, I've always been slightly amused by the notion of untrusted
proxies.  Under what circumstance would both the NAS and the ultimate
server be trusted, but the proxies not?  Everything that Radius does
is visible to the NAS and the server, and the NAS sees the caller's
data, too.  Genuine security is end-to-end, meaning caller's PC to
target host.  But I don't believe that there has been a collective
decision that nothing but end-to-end IPSEC is useful.

Barney Wolff

> Date: Fri, 10 Dec 1999 19:13:50 +0000 (GMT)
> From: Barry James <[email-masked]>
> 
> Does it make any sense to have a tag that tells the intermediate Proxies
> (if there are any) that they are to simply pass the AVP along without
> validating the data?  Then only the nearest-LAC-RADIUS would have the
> trusted relationship with the end-point RADIUS/LNS/whatever and do the
> voodoo there?  I can see issues with this (one being how does a RADIUS
> server know it's the nearest-LAC-RADIUS - maybe it can look at the
> NAS-Identifier or IP and if the remote server is the same then it can
> possibly assume it's the nearest-LAC-RADIUS) but I never fully understood
> why any intermediate proxies needed to know anything about LAC->LNS tunnel
> passwords.
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Gopal Dommety <[email-masked]>
Date: Fri, 10 Dec 1999 12:48:50 -0800 (PST)

Just to reinforce and continue of Barney's thought...

1. There could be trusted proxies (is is ard to imagine them?). In
which case hop-by-hop security might be acceptable to most.

2. If you want end-to-end security, then try to get it from PC to the
target host (have a AAA client on the PC). Or do key exchange via
other mechanisms.

3. If you don't do it end-to-end, what ever you do, one will always
have an entity that has access to the information. What if that entity
is untrusted? we can go on forever...

So, let us be realistic. People are implementing and using this
feature. Most of them understand the issues of  hop-by-hop security
and also understand the alternatives. If it helps have a statement
stating the risk of using this in an hop-by-hop environment.

Thanks
Gopal

-