Subject: RE: Making the hard choices on AAA security

From: "Martin Julien (ECE)" <[email-masked]>
Date: Thu, 18 Jan 2001 12:38:21 +0100

Steven,

Could we possibly think of allowing the Result-Code AVP to be encrypted for e2e, using the Strong Security extension of course, which would prevent proxies to play around with its content when not allowed by the server?

Martin

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]]
Sent: Thursday, January 18, 2001 11:16 AM
To: Steven Glass - Solaris Software
Cc: Bernard Aboba; Alain Zahm; [email-masked]
Subject: Re: Making the hard choices on AAA security

Steven Glass - Solaris Software wrote:
> 
> >
> >
> > > Bernard Aboba wrote:
> > >
> > > A proxy can change an Access-Accept into an Access-Reject under the guise of "policy". However, an
> > > Access-Reject should never be changed to an Access-Accept. A good question is how this could be
> > > enforced, using any of the solutions that have been proposed.
> >
> > Not sure it could...
> 
>     Maybe not from the solutions proposed...

Just for clarity, CMS, Kerberos and any other self-respecting 
e2e security solution will offer e2e data integrity. The "not 
sure" etc. refers to allowing one type of change and 
preventing/detecting another, not to simple integrity.

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: Steven Glass - Solaris Software <[email-masked]>
Date: Thu, 18 Jan 2001 15:12:33 -0500 (EST)

> Steven,
> 
> Could we possibly think of allowing the Result-Code AVP to be encrypted for
> e2e, using the Strong Security extension of course, which would prevent
> proxies to play around with its content when not allowed by the server?
> 
> Martin

    Sure, why not?  (If you're asking for a mobileip-centric viewpoint, I
don't see why this would generate any issues).  In this case, if a proxy
decided it wanted to deny (even if only based on the _unencrypted_ portion of
the answer it got back from the AAA server), it could always throw away
[x-bits of] the packet, and generate it's own reply - e.g. "error 666: I
didn't like the AAA server's tone".  This means some wasted cycles on securing
the e2e piece at the AAA server, but that possibility will never go away. 
Whenever there's a proxy involved, there's always going to have to be non-e2e
encrypted bits in the AAA server's response (if only based on likely policies
at the proxy), and Proxy decisions can always be made based on that info.

                              Cheers,
                                  Steve