Subject: [AAA-WG]: Apparent new goal of the interim meeting

From: Patrice Calhoun <[email-masked]>
Date: Thu, 5 Apr 2001 08:30:37 -0700 (PDT)

All,

I am sufficiently concerned that the AD has stated that one of the goals of
the interim meeting is to kill proxies. Proxies are universally used, and will
be required in the networks that I know of. Redirect mode is not an answer to
all problems.

I am really concerned with the obvious delays that would occur by killing this
feature, not to mention the lack of interest the market would have on a
protocol that doesn't meet its demands. Remember that the AAA WG had proxies
has a MUST in many access technologies, and the protocol meets the
requirements.

Is there actual WG concensus to killing proxies? Can the IESG decide that the
market is wrong, and the IETF will not support it?

PatC

---

From: John Schnizlein <[email-masked]>
Date: Thu, 05 Apr 2001 11:57:23 -0400

Pat,

I heard the goal differently.

Since the IETF has adopted a strategy of not standardizing protocols
that have security flaws, the security problems with AAA proxies 
must be resolved before Diameter progresses. IESG is expected to
enforce the consensus of the IETF on this subject, and ADs focus 
attention to this obligation on their own areas so that they need
fewer reminders from the security ADs.

We in this WG know the value of forwarding AAA requests to an
authoritative domain largely through the success the less-structured
RADIUS proxy provided for outsourcing dial access. We expect this
feature to be at least as important for the other access methods.
On the last Friday in Minneapolis, I did not hear consensus on what
we described as end-to-end security for attributes, which is an
essential part of keeping corporate secrets while outsourcing access.
We need a resolution of the collision between the need for security
and the need for inter-domain AAA.

Without claiming any particular expertise in the area, let me suggest
that arbitrary chains of proxies are really not necessary. If there
were only two domains - one proxy hop - with everything else done
through redirects, we might be able to find a solution that the
security area would find acceptable. Is this possible?

John

At 11:30 AM 4/5/2001, Patrice Calhoun wrote:
>... Remember that the AAA WG had proxies has a MUST in many access 
>technologies, and the protocol meets the requirements.
>
>Is there actual WG concensus to killing proxies? Can the IESG decide 
>that the market is wrong, and the IETF will not support it?

---

From: Randy Bush <[email-masked]>
Date: Thu, 05 Apr 2001 09:32:02 -0700

> I am sufficiently concerned that the AD has stated that one of the goals
> of the interim meeting is to kill proxies.

this particular AD did not say that.  what i said is that aaa will be
securable, proxies or not.

randy

---

From: Randy Bush <[email-masked]>
Date: Thu, 05 Apr 2001 09:36:22 -0700

> and the need for inter-domain AAA.

bingo!

> security area would find acceptable. Is this possible?

don't make me too hopeful.

randy

---

From: "Jari Arkko" <[email-masked]>
Date: Thu, 5 Apr 2001 20:03:08 +0300

> be required in the networks that I know of. Redirect mode is not an answer to

Oh? I must have missed that statement. Was it on this list or
in Minneapolis? I though in Minneapolis we were discussing
whether we mandate e2e security or not, and some folks
including the AD I think stated that they do not want a protocol
that does not have e2e security. 

So, is the issue to-have-e2e-security-or-not, or is the
issue proxies-suck-even-if-e2e-security-is-in-place?

I'd be surprised if the issue was the latter one, one
would think e2e security would enable us to hide the
necessary information. If the issue is mandating e2e
security, then it's a different matter. I'd rather mandate
e2e security than forget about proxies...

Jari

---

From: John Schnizlein <[email-masked]>
Date: Thu, 05 Apr 2001 13:29:52 -0400

>issue proxies-suck-even-if-e2e-security-is-in-place?

What I took from the discussion in Minneapolis is that transport
security between AAA client and server is easily resolved.
What we call e2e is the challenge of trusting a proxy to forward
securely information that it may not be able to interpret.
Whose signature is valid for what is one of the knotty problems.
Another problem is where along a chain of proxies policy can change
the values of what attributes.

The security experts did not go quite as far as the AAA person who
offered the opinion that proxies suck [sic]. They said they have not
seen solutions to the difficult problems, and until they do they will
not agree that the IETF standardize the approach.

My view is that those who said they don't care about e2e don't intend
to trust anyone else's proxy, but would not mind if other organizations
trusted theirs. This "I'm OK; I don't know about you." trust model is 
the sort that raises a red flag with security experts.

John
(not a security expert, but learned to respect them)

---

From: "Jari Arkko" <[email-masked]>
Date: Thu, 5 Apr 2001 21:02:51 +0300

> the values of what attributes.

Yes, but doesn't draft-calhoun-diameter-strong-crypto-07.txt
solve these issues?

> Whose signature is valid for what is one of the knotty problems.

Do you have a specific concern in mind wrt the above spec?

Note that even if we are talking about global roaming networks etc
we still are within a constrained set of servers belonging to a PKI.
[It's not like the case with mobile IP security problem, with all nodes
of the whole internet having to be members of the same PKI.]

Jari

---

From: "David Mitton" <[email-masked]>
Date: Thu, 05 Apr 2001 15:05:27 -0400

At 4/5/01 12:36 PM -0400, Randy Bush wrote:
><snip>...

 > John Schnizlein wrote:

I'm afraid I don't agree with you that arbitrary chains of proxies can be 
removed.  I don't think a lot of people in this WG do either.
I hesitate to call for feedback on this subject... but if we have to...

We do have to find a solution, even if some people are willing to live 
without it for practical reasons for awhile.  Otherwise I don't think we've 
really done anything with this protocol that isn't being done with RADIUS 
(with less overhead) today.

BTW: many people are running arbitrary chains of proxies with RADIUS.  Time 
for you to speak up.

         Dave.
---------------------------------------------------------------
David Mitton                                  ESN: 248-4570
Advisor, Nortel Networks                      978-288-4570 Direct
Wireless Solutions, IP Mobility
Billerica, MA 01821                    [email-masked]

---

From: Patrice Calhoun <[email-masked]>
Date: Thu, 5 Apr 2001 15:40:34 -0700 (PDT)

All,

It appears I misinterpreted the AD's original comment, and his comment was not
to kill proxies, but make sure that they are secure.

I appologize for causing any confusion,

PatC

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 6 Apr 2001 00:03:17 -0700

A few thoughts:

1. There are many networks that don't use any proxies at all. DIAMETER
supports those networks. So if the thought of a proxy makes you ill,
relax, DIAMETER does not force you to use them.

2. If your NAS needs some assistance in routing, then DIAMETER also has
something for you too. It's called re-direct.

3. If you are one of those that feels that you need a full-bodied,
policy enforcin', packet manglin' proxy, then guess what -- DIAMETER
supports that too.  In fact, it's got a strong crypto-extension so
powerful that it's barely indistiguishable from magic ;)

So my thought for the day is that we should document the above
(probably in the proxy draft), describe the choices and pros and
cons that are available, and leave it at that. With DIAMETER you've
got the tools necessary to design just about any AAA system you
could want. Of course, you can use that to shoot yourself in the
head, but hey, that's what powerful tools are for, right?

>the AD has stated that one of the goals of the interim meeting is to kill
proxies.

I am sad to say that I think we will have AAA proxies long after we've
all turned to dust. So I think it's a case of "you can't live with 'em,
you can't live without 'em."

I'd suggest that we all get over our profound disappointment at the
inelegance, kludginess and overall orneryness of proxies, and just
accept that they are necessary in some circumstances.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf
Of Patrice Calhoun
Sent: Thursday, April 05, 2001 8:31 AM
To: [email-masked]
Subject: [AAA-WG]: Apparent new goal of the interim meeting

All,

I am sufficiently concerned that the AD has stated that one of the goals of
the interim meeting is to kill proxies. Proxies are universally used, and
will
be required in the networks that I know of. Redirect mode is not an answer
to
all problems.

I am really concerned with the obvious delays that would occur by killing
this
feature, not to mention the lack of interest the market would have on a
protocol that doesn't meet its demands. Remember that the AAA WG had proxies
has a MUST in many access technologies, and the protocol meets the
requirements.

Is there actual WG concensus to killing proxies? Can the IESG decide that
the
market is wrong, and the IETF will not support it?

PatC

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 6 Apr 2001 00:10:15 -0700

>Yes, but doesn't draft-calhoun-diameter-strong-crypto-07.txt

I certainly hope so.

Stephen -- any ETA for the next version of the strong crypto spec? (hint,
hint)

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 09 Apr 2001 20:15:04 +0100

Bernard,

Taking the hint...within the next two weeks.

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com