Subject: [AAA-WG]: RE: [Mip4] dynamic keys

From: "James Jing" <[email-masked]>
Date: Wed, 11 Feb 2004 15:02:04 +1100

Why can't the session key be dynamically negotiated (say using
Diffie-Hellman) together with the Mobile-Node to AAAh (via HA etc)
mutual authentication messages? 

James Jing 

  _____  

From: Jeremy A. Greene [mailto:[email-masked]] 
Sent: Wednesday, February 11, 2004 11:19 AM
To: Henrik Levkowetz
Cc: [email-masked]; [email-masked]
Subject: [AAA-WG]: RE: [Mip4] dynamic keys

So, it doesn't make the initial deployment any easier (if there's one 
HA), just ongoing use more secure. Each MN needs to be manually 
configured in some manually intensive secure manner and/or use a 
proprietary mechanism. 

I guess I was looking more for a standardized server-side-only (aaa) 
configuration solution. More like the web, using server-side cert and 
client-side username/pw (over ssl). 

Jeremy 

-----Original Message----- 
From: Henrik Levkowetz [mailto:[email-masked]] 
Sent: Tuesday, February 10, 2004 7:00 PM 
To: Jeremy A. Greene 
Cc: [email-masked]; [email-masked] 
Subject: Re: [Mip4] dynamic keys 

Hi Jeremy, 

Tuesday 10 February 2004, Jeremy A. Greene wrote: 
> In the mip4-aaa-key-03 draft (and aaa-diameter-mobileip-16) it 
requires 
> the use of a single, widely used (by all MNs??), long term pre-shared 
> key between the MN and AAAH. Since this key is directly used to 
> calculate dynamic keys, this does not seem terrible secure. 

I see no reason why the preshared key between MN and AAAH should be the 
same for all MNs, rather than individual per-MN?  Or is it I who have 
missed something? 

        Henrik 
This e-mail, and any attachments hereto, is intended only for use by the
named addressee(s) and may contain legally privileged and/or
confidential information.  If you are not the intended recipient, you
are hereby notified that any dissemination, distribution or copying of
this e-mail, and any attachments hereto, is strictly prohibited.  If you
have received this transmission in error, please notify me immediately
and permanently delete the original and all copies and printouts of this
e-mail.