Subject: issue 18: aaa interactions

From: Jari Arkko <[email-masked]>
Date: Thu, 21 Aug 2003 21:04:22 +0300

Hi,

I'm going through the open issues we have in the SEND
protocol. One of them was raised by you Francis on AAA
interactions. Here's the discussion we had:

> Francis Dupont writes: "The Authorization Delegation Discovery process
> does not exclude other forms of discovering the certificate chains.
> For instance, during ... " IMHO this is the right place to introduce
> interaction with AAA systems.  If you'd like to use SEND in 802.11 hot
> spots, you have to talk about this!
> 
> ------
> 
> Jari Arkko responds to Francis Dupont: Do you have a specific
> suggestion regarding the interaction? Do you wish to download certs
> from the AAA, or what?

Now, I've been thinking about this a little bit.
If this is *only* about the discovery of the cert chains
via AAA, then it might be that, for instance, the 802.11
link layer authentication process has already learned
something about the network's certificates. For instance,
if 802.11 is running EAP TLS, and the authentication is
terminated directly at the AP/router, then the host already
has the cert chain from a trusted root to the router.

The only question at that point is whether the cert chain
is usable for other purpose, i.e. whether the authorizations
are sufficient for both purposes. TLS certs are a bit special,
as are SEND certs...

Also, cert-based authentication which terminates at the local
router may be rare in practise.

In any case, to move forward my proposal is that we simply
add some text explaining that as a side effect of attaching
to the network, it may be that the host already has some
cert chains from the network, and that it MAY use them in
order to optimize (skip) the SEND cert retrival. Does
that work for you?

--Jari

P.S. The issue list is at
http://www.piuha.net/~jarkko/publications/send/issues/

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Alper Yegin <[email-masked]>
Date: Thu, 21 Aug 2003 17:53:10 -0700

> order to optimize (skip) the SEND cert retrival. Does

It might even be the case that the cert used is not part of any chain and
the solution does not rely on global PKI. For example, a more practical
solution could be to deliver a public key for the visited domain to the host
during the access AAA. This PK can be produced by the access network and its
delivery to the host can be protected by the local security association
created during AAA. This solution skips the cert chain discovery and removes
the dependency on any PKI.

Furthermore, we shouldn't even assume that secure router discovery will
always be used along with secure neighbor discovery. One can run a network
where potentially malicious hosts are always on one side of a bridge and the
bridge filters "router advertisements" coming from that side.

Alper