Subject: RE: [AAA-WG]: [issue] Usage of TLS and IPsec

From: <[email-masked]>
Date: Tue, 19 Feb 2002 09:29:16 +0200

Hi Jari,

> One more thing. Thinking about this some more, while I
> do not necessarily agree with the IESG suggestion on
> intra and inter, this happens to coincide with what I think
> has been the intent (if not the letter) of the current spec.
> That is, you run IPsec, perhaps shared-secret keyed
> (if not even manually but here I think Bernard and I had
> a disagreement) on the edges, and then servers mainly
> communicate with each other using TLS. So could
> state something like this at the end of my suggested
> note below:
> 
>   It is suggested that IPsec can be used primarily at the
>   edges and in intra-domain traffic, such as using pre-shared
>   keys between a NAS a local AAA proxy. This also eases
>   the requirements on the NAS to support certificates. It is
>   also suggested that inter-domain traffic would primarily use
>   TLS.

This is what I was intending to suggest as text - but you put
it much more elequently than I.  I agree with your text.

John

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 18 Feb 2002 23:01:09 -0800 (PST)

> also suggested that inter-domain traffic would primarily use

Out of curiosity - it is AAA servers that will be involved in inter-domain
traffic not NASes, correct? So is there anything wrong with the original
text (requiring IPsec on NASes)?

---

From: "Jari Arkko" <[email-masked]>
Date: Tue, 19 Feb 2002 10:04:02 +0200

> text (requiring IPsec on NASes)? 

Right. In fact, to follow the IESG inter-intra recommendation, the
original NAS MAY was quite OK, wasn't it? Perhaps we should just
have clarified the where these things are being used network
wise.

Jari

---

From: Randy Bush <[email-masked]>
Date: Tue, 19 Feb 2002 07:57:53 -0800

why should a security-conscientious ietf not take a position in the vein of
  o inter-agent authentication of some form is mandatory
  o inter-agent traffic encryption of some form is mandatory
  o these must always be on?

randy

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 19 Feb 2002 07:28:12 -0800 (PST)

>   o these must always be on?

This makes sense to me. Making security mandatory to implement but not
mandatory to use doesn't make sense in this case. After all, with RADIUS
security was mandatory to use.