Subject: RE: [AAA-WG]: Issue 303: Security model for peer discovery and redirect

From: <[email-masked]>
Date: Tue, 12 Mar 2002 16:41:50 +0200

Hi Randy,

> > Remember that a redirect makes lots of sense in the case where the
> > redirect server is owned by a "broker". The broker would typically
> > act as a certificate authority, and would ensure that all of the
> > roaming consortium members have certificates that are signed by the
> > CA. This provides the trust that is needed in the protocol.
> 
> so, if i do not have a signed cert of the host trying to contact me,
> the protocol will say that i MUST reject the connection?

Is this something that we would need to mandate - or is it something
we should advise on?  I generally don't like these kind of MUST requirements,
as it gets to a deployment issue, as opposed to an interoperability 
issue.  If someone wants to hang their butt out in the open air ...
Or are you suggesting that fundamentally this is an interoperability
issue that MUST be enforced by the protocol?

John

---

From: David Frascone <[email-masked]>
Date: Tue, 12 Mar 2002 10:04:27 -0600

I think advising is sufficient.  (Actually, I think advising is a MUST, but
mandating is a SHOULD NOT) :)

-Dave

-- 
David Frascone

                 George Orwell was an optimist.

---

From: Randy Bush <[email-masked]>
Date: Tue, 12 Mar 2002 08:23:24 -0800

> Is this something that we would need to mandate - or is it something we
> should advise on?  I generally don't like these kind of MUST requirements,
> as it gets to a deployment issue, as opposed to an interoperability issue.

this is generally handled by
  o mandatory to implement
  o on by default, but configurable
  o recommended not to change default

randy

---

From: David Spence <[email-masked]>
Date: Tue, 12 Mar 2002 11:30:45 -0500

This is a subcase of the one I just commented on.  Again, it's a good start
but insufficient.  You not only need a signed cert but the cert needs to
convey authorization -- not just authentication.  So you need to describe
what that means.  And you really do need to do some enforcing in the
protocol.  Specifying that you need a signed cert says that IPsec is not
sufficient protection in some cases.