Subject: RE: Making the hard choices on AAA security

From: Pat Calhoun <[email-masked]>
Date: Thu, 18 Jan 2001 10:00:21 -0800

For proxies that wish to maintain state information, not having access
to the result code would be a problem.

Perhaps e2e authenticated, but not encrypted.

PatC
>Steven,
>
>Could we possibly think of allowing the Result-Code AVP to be encrypted for e2e,
>using the Strong Security extension of course, which would prevent proxies to
>play around with its content when not allowed by the server?
>
>Martin
>
>-----Original Message-----
>From: Stephen Farrell [mailto:[email-masked]]
>Sent: Thursday, January 18, 2001 11:16 AM
>To: Steven Glass - Solaris Software
>Cc: Bernard Aboba; Alain Zahm; [email-masked]
>Subject: Re: Making the hard choices on AAA security
>
>
>
>
>Steven Glass - Solaris Software wrote:
>> 
>> >
>> >
>> > > Bernard Aboba wrote:
>> > >
>> > > A proxy can change an Access-Accept into an Access-Reject under the guise
>of "policy". However, an
>> > > Access-Reject should never be changed to an Access-Accept. A good question
>is how this could be
>> > > enforced, using any of the solutions that have been proposed.
>> >
>> > Not sure it could...
>> 
>>     Maybe not from the solutions proposed...
>
>Just for clarity, CMS, Kerberos and any other self-respecting 
>e2e security solution will offer e2e data integrity. The "not 
>sure" etc. refers to allowing one type of change and 
>preventing/detecting another, not to simple integrity.
>
>Stephen.
>
>-- 
>____________________________________________________________
>Stephen Farrell         				   
>Baltimore Technologies,   tel: (direct line) +353 1 881 6716
>39 Parkgate Street,                     fax: +353 1 881 7000
>Dublin 8.                mailto:[email-masked]
>Ireland                             http://www.baltimore.com
>

---

From: Steven Glass - Solaris Software <[email-masked]>
Date: Thu, 18 Jan 2001 17:33:36 -0500 (EST)

> Perhaps e2e authenticated, but not encrypted.

    This is the foundation of my point, and of course Pat said it better than
I.  I took it as a given that if the AAA response is e2e encrypted, the
approval info has to be some place else for the proxy to see!

                              Cheers,
                                  Steve