Subject: Re: (radius) Comments on Tunnel Draft

From: Patrice Calhoun <[email-masked]>
Date: Fri, 10 Dec 1999 11:25:04 -0800

Unfortunately, RADIUS has a hop-by-hop security model, so what you are
proposing here wouldn't work :(

PatC
>Does it make any sense to have a tag that tells the intermediate Proxies
>(if there are any) that they are to simply pass the AVP along without
>validating the data?  Then only the nearest-LAC-RADIUS would have the
>trusted relationship with the end-point RADIUS/LNS/whatever and do the
>voodoo there?  I can see issues with this (one being how does a RADIUS
>server know it's the nearest-LAC-RADIUS - maybe it can look at the
>NAS-Identifier or IP and if the remote server is the same then it can
>possibly assume it's the nearest-LAC-RADIUS) but I never fully understood
>why any intermediate proxies needed to know anything about LAC->LNS tunnel
>passwords.
>
>Barry
>
>Barry L James            | Never doubt that a small group of
>IP Systems Engineering   | thoughtful, committed citizens can
>Level 3 Communications   | change the world.  Indeed, it's 
>http://www.level3.com    | the only thing that ever has.
>Member IEEE, AAAI        | #include <std_disclaimer>
>
>

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Patrice Calhoun <[email-masked]>
Date: Fri, 10 Dec 1999 13:06:23 -0800

>
>
>Just to reinforce and continue of Barney's thought...
>
>
>1. There could be trusted proxies (is is ard to imagine them?). In
>which case hop-by-hop security might be acceptable to most.

You know, I trust my admin. She takes care of most of my paperwork and
travel plans. Do I provide her with my passwords? 

There are different levels of trust here.

>
>2. If you want end-to-end security, then try to get it from PC to the
>target host (have a AAA client on the PC). Or do key exchange via
>other mechanisms.

I would be quite interested in understanding how you would do end to end
by having an AAA client on the PC. I wonder how many providers out there
would permit end-to-end authentication, and allow the PC to generate 
accounting information too. So, EAP is the REAL solution here, but we
aren't talking about end-to-end authentication, but rather distribution
of keys as part of the authorization phase.

Now, if you want to enforce end-to-end, simply enfoce voluntary tunneling
as opposed to compulsory. I'm not making a statement that compulsory shouldn't
be allowed, btw, just responding to Gopal's comments. As I stated earlier,
I like this draft, modulo that attribute.

>
>3. If you don't do it end-to-end, what ever you do, one will always
>have an entity that has access to the information. What if that entity
>is untrusted? we can go on forever...

Well, if you are going to provide compulsory tunneling, then that is the
risk you must be willing to take.

>
>So, let us be realistic. People are implementing and using this
>feature. Most of them understand the issues of  hop-by-hop security
>and also understand the alternatives. If it helps have a statement
>stating the risk of using this in an hop-by-hop environment.

From some responses to this mailing list, I'm not sure that everyone does
in fact understand hop-by-hop security.

PatC
>
>
>Thanks
>Gopal
>
>
>
>> 
>> If the NAS and server knew about each other and shared a secret, there
>> would be no need for proxies.  But in the normal proxy case, they don't,
>> so there is no easy way to encrypt Tunnel-Password or User-Password
>> server-to-NAS.
>> 
>> However, I've always been slightly amused by the notion of untrusted
>> proxies.  Under what circumstance would both the NAS and the ultimate
>> server be trusted, but the proxies not?  Everything that Radius does
>> is visible to the NAS and the server, and the NAS sees the caller's
>> data, too.  Genuine security is end-to-end, meaning caller's PC to
>> target host.  But I don't believe that there has been a collective
>> decision that nothing but end-to-end IPSEC is useful.
>> 
>> Barney Wolff
>> 
>> > Date: Fri, 10 Dec 1999 19:13:50 +0000 (GMT)
>> > From: Barry James <[email-masked]>
>> > 

-

---

From: Carl Rigney <[email-masked]>
Date: Thu, 16 Dec 1999 14:57:46 -0800 (PST)

[email-masked] writes:
> Genuine security is end-to-end, meaning caller's PC to

Very well said.

--
Carl Rigney
-