Subject: Re: [Seamoby] comments on CAR Discovery Requirements

From: "Hemant Chaskar" <[email-masked]>
Date: Thu, 14 Mar 2002 23:00:37

Hi James:

Rather than starting from scratch again in Minneapolis, may I propose that 
we start from the following baseline text for security requirements. I think 
this text very clearly and explicitly brings out the security issues 
involved. If any additional statements are needed we can fill them in. Sorry 
to repeat this, but I did not see any reference to earlier discussion on 
this text in Hesham's email.

"Solution to CAR discovery  MUST address the security concerns involved in 
the various aspects such as GAAR discovery, capability exchange and CAR 
selection. In particular,

a) The solution MUST provide means for an AR to to verify that another AR 
claiming to be its GAAR is genuine. In other words, the other AR is indeed a 
GAAR and it is an authentic router. The authenticity of a router MAY mean 
that it is authorized to act as an access router by the jurisdiction of the 
environment (operator network, organizatoinal LAN, home network etc.) that 
the router resides in.

b)It MUST provide means for secure capability exchange between an AR and its 
GAAR.

c)It MUST provide secure means for the expression of MN requirements to CAR 
selection algorithms."

Regards,
Hemant

>From: "James Kempf" <[email-masked]>
>To: "Hesham Soliman \(ERA\)" <[email-masked]>,        
>"'Govind Krishnamurthi'" <[email-masked]>, <[email-masked]>
>Subject: Re: [Seamoby] comments on CAR Discovery Requirements
>Date: Thu, 14 Mar 2002 14:34:29 -0800
>
>Hesham,
>
> >   > Re. the comments on security, maybe we need a more
> >   > comprehensive threat
> >   > analysis such as Claude did for paging?
> >   > The requirement I did was pretty generic.
> >
> > => Agreed. No need for a separate doc. This
> > is what I was hinting at when I said 'I can try'.
> > Because this is something that will take time.
> >
>
>Good, let's talk about this in the Minne-apple.
>Maybe we can get together a small group
>of volunteers to help. It should
>not take much time, and I agree that we
>don't need a separate document, but
>I think we need something more than
>we have now.
>
>             jak
>
>
>_______________________________________________
>Seamoby mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/seamoby

_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: "James Kempf" <[email-masked]>
Date: Thu, 14 Mar 2002 15:41:22 -0800

Hemant,

I think it would be useful to have a threat analysis. The threat
analysis that was done for paging was extremely useful in uncovering
necessary security requirements. What you have listed below are fairly
high level goals. A more detailed threat analysis with these goals in
mind might turn up some more specific requiremnts.

Hesham has indicted some interest in participating, perhaps you would
like to as well?

            jak

----- Original Message -----
From: "Hemant Chaskar" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, March 14, 2002 11:00 PM
Subject: Re: [Seamoby] comments on CAR Discovery Requirements

> Join the world's largest e-mail service with MSN Hotmail.
> http://www.hotmail.com
>
>

---

From: "James Kempf" <[email-masked]>
Date: Thu, 14 Mar 2002 15:41:22 -0800

Hemant,

            jak