Subject: Re: [Mip4] dynamic keys

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 11 Feb 2004 01:33:42 +0100

Hi Jeremy,

Tuesday 10 February 2004, Jeremy A. Greene wrote:
> So, it doesn't make the initial deployment any easier (if there's one
> HA), just ongoing use more secure. Each MN needs to be manually
> configured in some manually intensive secure manner and/or use a
> proprietary mechanism.
> 
> I guess I was looking more for a standardized server-side-only (aaa)
> configuration solution. More like the web, using server-side cert and
> client-side username/pw (over ssl).

But this is the same difference.  If you can distribute username/passwd
individually to users, you have your initial deployment shared secret,
no?

	Henrik

---

From: "Jeremy A. Greene" <[email-masked]>
Date: Tue, 10 Feb 2004 19:19:11 -0500

Jeremy

-----Original Message-----
From: Henrik Levkowetz [mailto:[email-masked]] 
Sent: Tuesday, February 10, 2004 7:00 PM
To: Jeremy A. Greene
Cc: [email-masked]; [email-masked]
Subject: Re: [Mip4] dynamic keys

Hi Jeremy,

Tuesday 10 February 2004, Jeremy A. Greene wrote:
> In the mip4-aaa-key-03 draft (and aaa-diameter-mobileip-16) it
requires
> the use of a single, widely used (by all MNs??), long term pre-shared
> key between the MN and AAAH. Since this key is directly used to
> calculate dynamic keys, this does not seem terrible secure.

I see no reason why the preshared key between MN and AAAH should be the
same for all MNs, rather than individual per-MN?  Or is it I who have
missed something?

	Henrik

-- 
Mip4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip4

---

From: Tom Hiller <[email-masked]>
Date: Wed, 11 Feb 2004 08:51:37 -0600

Jeremy,

In 3GPP2 there is an over the air provisioning mechanisms that sets up a 
TLS connection between the mobile and a trusted provisioning server. 
The mobile runs http over TLS to get various parameters, including the 
MN-AAA shared secret.  The trusted provisioning system provides this 
information to the home AAA server of the mobile, too.  The trusted 
provisioning system can run without user intervention, so that mobile 
station information may be updated.

http://www.3gpp2.org/Public_html/specs/C.S0040-0_v1.0_110403.pdf

	- Tom