Subject: [saag] Invitation to subscribe to IETF proxy mailing list

From: "Katrin Höper" <[email-masked]>
Date: Wed, 16 Apr 2008 17:55:19 -0400

Hi,

Security problems related to network proxies persistently come up
in several IETF WGs and may affect the security of existing IETF network
solutions while slowing down the progress of some current Internet Drafts.

For this reason, Tim Polk and I organized an informal meeting in
Philadelphia at IETF 71 to discuss these so-called "proxy problems" and
their implications. As a result of our meeting, a proxy email list was
created to further investigate the proxy problems.

This email serves as an invitation to anybody interested to join
our discussions on the list. Please subscribe at:
https://www.ietf.org/mailman/listinfo/proxies

Best regards,

Katrin Hoeper

 ______________________________________________

Katrin Hoeper
Computer Security Division
National Institute of Standards and Technology (NIST)
100 Bureau Dr. Mail stop: 8930
Gaithersburg, MD 20878
(301) 975 - 4024

---

From: Richard Barnes <[email-masked]>
Date: Wed, 16 Apr 2008 22:21:42 -0400

Katrin,

Could you clarify what type of "proxies" are being discussed on this 
list?  What layers of the stack are you looking at?
Network: Mobile IP Home Agents
Transport: TURN servers
Application: HTTP proxies, SIP proxies
Or are you looking at the concept of proxying in general?

The text of both messages in the list archive seemed pretty agnostic, 
but there were attachments discussing AAA proxies.  Is AAA the focus of 
this list?

--Richard

Katrin Höper wrote:
> ------------------------------------------------------------------------
> 
> _______________________________________________
> saag mailing list
> [email-masked]
> http://mailman.mit.edu/mailman/listinfo/saag

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 16 Apr 2008 22:58:03 -0700 (PDT)

> but there were attachments discussing AAA proxies.  Is AAA the focus of 

If so, why isn't this being handled in the O&M Area?

---

From: "Katrin Höper" <[email-masked]>
Date: Thu, 17 Apr 2008 15:30:39 -0400

Hello Richard,

We decided to use AAA proxies as a starting point for our discussion for
simplicity. In addition, people present at the initial meeting were most
familar with these type of proxies and the security issues they introduce.
The long-term (and ideal) goal of the list could be to extend the results of
the AAA discussion in order to adress proxy-related security issues in
general. However, for now we will focus on AAA proxies.

Katrin
On Wed, Apr 16, 2008 at 10:21 PM, Richard Barnes <[email-masked]> wrote:

> Katrin,
>
> Could you clarify what type of "proxies" are being discussed on this list?
>  What layers of the stack are you looking at?
> The text of both messages in the list archive seemed pretty agnostic, but
> there were attachments discussing AAA proxies.  Is AAA the focus of this
> list?
>
> --Richard
>
>
>
> Katrin Höper wrote:
>
> >  Hi,
> >
> >
> > Security problems related to network proxies persistently come up in
> > several IETF WGs and may affect the security of existing IETF network
> > This email serves as an invitation to anybody interested to join our
> > discussions on the list. Please subscribe at:

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 17 Apr 2008 13:32:13 -0700

>We decided to use AAA proxies as a starting point for our discussion 
>for simplicity.

I don't remember the last time I read a sentence that contained both 
"AAA proxies" and "simplicity".

>The long-term (and ideal) goal of the list could be to extend the 
>results of the AAA discussion in order to adress proxy-related 
>security issues in general. However, for now we will focus on AAA 
>proxies.

Lots of application proxies have *very* different properties than AAA 
proxies. It will be interesting to see how much of the AAA work will 
be applicable.

--Paul Hoffman, Director
--VPN Consortium