Subject: RE: [Dime] Diameter Mobile IPv6 HA-to-AAAH Support: Issue or notIssue ?

From: Julien Laganier <[email-masked]>
Date: Thu, 25 Jan 2007 17:57:26 +0100

Hi Lionel,

Interfering a bit in your discussion:

> Hi Yoshi,
> 
> 1) If authentication procedures may be performed 
> apart from authorization procedures (I totally 
> agree), authorization procedures must be able to rely 
> on its own authentication procedures if needed (cf. 
> AAA requirements in RFC 2906). Are you OK with that?    

Sure. I think nobody argued about combining the two 
where it makes sense. But, we also want to support 
situations in which they are not combined. As per 
RFC2906.

> 2) As it is now, providing authentication with 
> Diameter EAP application and authorization with 
> Diameter MIP6 does not allow the AAA-MIP6 to be sure 
> that the username carried in the authorization 
> request was previously authenticated by the AAA-EAP. 
> Are you OK with that?     

But this is the whole point of the split between 
Authorization and Authentication split. You do not 
want the AAA-MIP6 to be sure of anything about whether 
the username is right or false. That is the role of 
authentication.

To quote the Handbook of Applied Cryptography [1]:

   entity authentication: corroboration of the identity
   of an entity (e.g., a person, a computer terminal, a
   credit card, etc.).

   authorization: conveyance, to another entity, of
   official sanction to do or be something.

There's nothing in the above definition that states 
that the authorizer has to verify authentication.

> 3) If the AAA-MIP6 provides the HA with service 
> related information without being sure that the key 
> entry (username) was previously authenticated, what 
> is the difference between the AAA-MIP6 and a "simple" 
> external database providing information data to any 
> authorized entity (HA in the present case)? 
> What/where is the authorization process in that case?      

See above.

> 4) If combining Diameter EAP and Diameter MIP6 is 
> more complex than including authentication procedures 
> with Diameter MIP6 that is coherent with AAA 
> requirements, why are we still discussing as much? ;)   

Because people like to argue :)

We have to support non-AAA-based MIP6 authentication, 
and that is not possible by combining the two. Hence, 
it's not consistent with AAA requirement 2.2.6 ("For 
example, if IPSec provides sufficient authentication, 
then it must be possible to omit AAA protocol 
authentication.)

> 5) If the discussion is beyond the scope of the draft 
> and related to the future of global AAA framework, 
> why do not "decouple" the discussions and create a 
> separate thread? But for now, I can see that a 
> Diameter MIP6 application with authentication 
> procedure would be consistent with the current AAA 
> framework while a combinaison of Diameter EAP and 
> Diameter MIP6 will not meet all the AAA requirements 
> without introducing specific 
> functionalites/enhancements.         

No, that's combining the two that breaks requirement.

> I would have no problem with a solution proposing EAP 
> authentication procedures and MIP6 authorization 
> procedures supported by to different diameter 
> applications IF it could be possible to bind both 
> procedures in the same equipment in the MSA. That is 
> not the case with the current solution.     

Authorization hasn't to be bound to authentication. 
However, at the enforcement point (HA) it has to be 
made sure that authenticated user are authorized to 
access one service.

Best,

--julien

[1] Handbook of Applied Cryptography, by A. Menezes, P. 
van Oorschot, and S. Vanstone, CRC Press, 1996.  
<http://www.cacr.math.uwaterloo.ca/hac>

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime