Subject: Re: [abfab] #28: Missing Security Consideration - AAA protection of the MSK

From: "abfab issue tracker" <[email-masked]>
Date: Sat, 10 Mar 2012 12:09:51 -0000

#28: Missing Security Consideration - AAA protection of the MSK

Changes (by hannes.tschofenig@…):

 * cc: hannes.tschofenig@… (added)
 * status:  new => closed
 * resolution:   => fixed

Comment:

 RADIUS and Diameter currently provide the same level of security when it
 comes to the protection of the protocol exchanges between neighboring
 RADIUS/Diameter nodes.

 There is no end-to-end security mechanism (i.e., RADIUS client <-> RADIUS
 server; Diameter client <-> Diameter server) standardized although there
 are discussions in the DIME working group to add functionality. An example
 contribution can be found with http://tools.ietf.org/html/draft-korhonen-
 dime-e2e-security-00 and with  http://tools.ietf.org/html/draft-zorn-dime-
 n2n-sec-lite-02.

 I would suggest to raise the issue of MSK security in the security
 consideration section. I put a placeholder there.

-- 
--------------------+--------------------------------------
 Reporter:  ietf@…  |       Owner:  draft-ietf-abfab-arch@…
     Type:  defect  |      Status:  closed
 Priority:  major   |   Milestone:
Component:  arch    |     Version:
 Severity:  -       |  Resolution:  fixed
 Keywords:          |
--------------------+--------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/abfab/trac/ticket/28#comment:1>
abfab <http://tools.ietf.org/abfab/>

---

From: "abfab issue tracker" <[email-masked]>
Date: Sun, 18 Mar 2012 06:26:33 -0000

Changes (by ietf@…):

 * status:  closed => reopened
 * resolution:  fixed =>

Comment:

 You did in fact make the general change that was requested, however I
 think this needs to be an extremely explicit statement on the lack of
 protection.

 Currently text in -01 requires that the reader knit this together from

 Client <-> RP
 no security until the MSK is sent from the IdP

 RP <-> IdP
 Everything is point to point.

 I thin that in the RP <-> IdP the text should include

 Since all of the security is provided on a Point-to-Point bases, and the
 RP cannot know if the message is seen by a AAA proxy, there is always a
 possibility that a AAA proxy can break the security.

-- 
--------------------+--------------------------------------
 Reporter:  ietf@…  |       Owner:  draft-ietf-abfab-arch@…
     Type:  defect  |      Status:  reopened
 Priority:  major   |   Milestone:
Component:  arch    |     Version:
 Severity:  -       |  Resolution:
 Keywords:          |
--------------------+--------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/abfab/trac/ticket/28#comment:2>
abfab <http://tools.ietf.org/abfab/>