Subject: [AAA-WG]: Re: Evaluation: draft-ietf-aaa-diameter-mobileip - Diameter Mobile IPv4 Application to Proposed Standard (fwd)

From: Bernard Aboba <[email-masked]>
Date: Sun, 17 Nov 2002 06:12:25 -0800 (PST)

------- start of forwarded message -------
From: "Steven M. Bellovin" <[email-masked]>
To: IESG Secretary <[email-masked]>
Cc: Internet Engineering Steering Group <[email-masked]>
Subject: Re: Evaluation: draft-ietf-aaa-diameter-mobileip - Diameter Mobile IPv4 Application to Proposed Standard
Date: Thu, 14 Nov 2002 01:39:45 -0500

In message <[email-masked]>, IESG Secretary writes:
>
>Last Call to expire on: 2002-10-30
>
>	Please return the full line with your position.
>
>                    Yes    No-Objection  Discuss *  Abstain
>
>
>Steve Bellovin      [   ]     [   ]       [ X ]      [   ]

1.6:  What is a "preconfigured shared security association"?  Do you
mean a preshared secret?  A security association comprises far more
than just a key.

I have not evaluated the security of the scheme in this section, since
it depends on another draft, and possibly on the security of MobileIP
itself.  Can we really even consider this draft until those are done?

1.10: What firewall rules?  Are the agents supposed to tell their local
firewalls to open up some holes?

5.2: 64 bits is not sufficient for a key.  Why not just mandate 128,
instead of strongly recommending it?

5: I confess that it still isn't clear to me how the home and foreign
agents know authoritatively who each other are.  Then again, that's
always been my main complaint about AAA.  But here they're handing out
keys.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

------- end of forwarded message -------