Subject: RE: [AAA-WG]: MIP-Session-Key

From: "s. goswami" <[email-masked]>
Date: Wed, 16 Oct 2002 15:01:06 -0400 (EDT)

On Wed, 16 Oct 2002, Paul Krumviede wrote:

> --On Wednesday, 16 October, 2002 09:33 -0700 Subrata Goswami
> <[email-masked]> wrote:
>
> > Frederik, I am looking at the problem from a different angle.  Setting
> > up these TLS/IPSec associations do not scale to large number of nodes.
> > If there are n AAA nodes, then it is n*n manual configuation. Whereas
> > what I am suggestin would reduce that to n or linear.
>
> huh? why can't you use IPsec with certificates? then one might need
> to configure servers within an administrative domain to establish IPsec
> security associations based on a common CA (sub-linear), and to
> configure security associations with other administrative domains
> by doing something like configuring a CA cert for each such domain
> (at worst, linear in the number of domains).
>
Lt us see if I understand what you are saying. You use certificates for
each node from a common CA. Then you establish an IPSec SA ( say with
IKE). This happens with  AMA and HAA.  So there is an IPSec SA from FA
to AAAF, from AAAF to AAAH, from AAAH to HA.  Thus there is an additional
requirement on the FA and HA to be IPSec terminations. Moreover the CA
chain for PKI need to be setup.  Further more these messages are
essentially one time signalling messages, do we need to keep IPSec
sessions open for such sporadic messages ?

We are already using a shared secret between MN-AAAH, so why not use
the same approach for FA-AAAF, HA-AAAH. The AAAF-AAAH might be better
serverd by a certificate approach, as it is not possible to say
a priori when they need to have an association.

> there has been a fair amount of work to allow IPsec, at least, to
> scale to large numbers of nodes.

Can you please cite one refernce ? I would certainly love to find out
about the biggest IPSec network.

> -paul