Subject: Re: [Spud] endpoint control

From: "Diego R. Lopez" <[email-masked]>
Date: Fri, 1 Jul 2016 09:22:13 +0000

Hi,

(text trimmed to ease reading)

On 1 Jul 2016, at 24:05 , Brian Trammell <[email-masked]<mailto:[email-masked]>> wrote:

On 30 Jun 2016, at 19:41, 🔓Dan Wing <[email-masked]<mailto:[email-masked]>> wrote:

On 30-Jun-2016 08:33 am, Brian Trammell <[email-masked]<mailto:[email-masked]>> wrote:

Well, you need the endpoint to know which and what kinds of middleboxes its traffic is likely to encounter on the way to the other endpoint. There are three cases I can think of here:

1. An enterprise device can authenticate the enterprise firewall and/or VPN gateway.

2. A mobile handset can authenticate infrastructure in the mobile access network.

3. A server in a data center can authenticate infrastructure in the data center network.

(You could extend 1 to include home access networks as well, but getting the in-home devices and the gateways to authenticate each other reliably is an area that still needs some work to keep from being a giant support-call generator.)

In all three of these cases, the authentication relationship doesn't cross an administrative domain boundary. In an Internet context, this is what I mean by "limited". Note that it *doesn't* cover the case where a data center server says something to the mobile access network, or the handset and the server cooperate to say something to the same network, because as soon as you cross the admin domain boundary the device-to-device authentication problem quickly becomes intractable.

Building a common framework for making this kind of authentication work is a very interesting problem,

Yes.  I was hoping you had a solution.

Sadly, no. I do believe the problem can be scoped in such a way that a useful solution is possible... but I don't know what it looks like.

I very much agree this would be highly desirable, and there are a couple of pieces of work that could become applicable: Phillip Halam-Baker’s Mathematical Mesh (that you can summarize as a personal PKI, see http://prismproof.org/) and the ABFAB WG. And let me note there will be a (second) IRTF session on service federation infrastructures in Berlin (https://trac.tools.ietf.org/group/irtf/trac/wiki/blockchain-federation and https://www.irtf.org/mailman/listinfo/din) that I think is related to this discussion.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição