Subject: RE: [Mipshop] MIPSHOP discussion on new items and milestones

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Thu, 17 Mar 2005 12:22:53 -0600

Jari,
I agree with Vijay. AAA is the most widely deployed authentication mechanism today in many networks (enterprises use it for remote access VPNs, providers use it for network access, etc.). It seems useful to take a look at how to leverage this for deriving handover keys. 

It seems to especially make sense when mip6 is also considering AAA-based mechanisms for bootstrapping MNs. 

Until PKI becomes more prevalent, I think we will be stuck supporting AAA-based key derivation. 

Vidya

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Vijay Devarapalli
Sent: Thursday, March 17, 2005 11:45 AM
To: Jari Arkko
Cc: gabriel montenegro; [email-masked]
Subject: Re: [Mipshop] MIPSHOP discussion on new items and milestones

hi Jari,

Jari Arkko wrote:

> - MN-AR security is a significant issue in current specifications, and 
> as such addressing it would be really useful. But I wonder about the 
> need to have two different solutions in this space. Seems like James' 
> draft would technically work in all scenarios. What he said about the 
> IPR sounded positive too (but I am not a lawyer nor have I looked at 
> the relevant patents).

in some networks, where there is access network authentication using AAA access, it might make sense to setup keys for securing FBU along with access authentication. so, I think we should take a look at this solution too.

Vijay

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Thu, 17 Mar 2005 10:35:02 -0800

Vidya,

If an AAA key draft is to be moved to IETF, I think we need to discuss how
it helps handover optimization. I don't think it would be acceptable to
optimize routing change with FMIP only to have key deriviation become a new
bottleneck, especially since, as Jari says, the SEND derived key draft could
provide security with minimal impact on optimization.

This problem is currently under discussion in 802.11r, though, in this case,
the constraints are a little looser.

Regarding your comment about PKI, SEND doesn't require per host certificate
provisioning, so the service provider need not deploy a full PKI. It only
requires trust anchors on the host (like SSL) and router certificate
provisioning, something that is likely to occur anyway since ISPs will be
increasing router security in the future. Since IPv6 has yet to see
widespread deployment, I think it is too early to tell whether the SEND
model will be acceptable or not. It was certainly designed with practical
deployment in mind.

            jak

----- Original Message ----- 
From: "Narayanan Vidya-CVN065" <[email-masked]>
To: "'Vijay Devarapalli'" <[email-masked]>; "Jari Arkko"
<[email-masked]>
Cc: "gabriel montenegro" <[email-masked]>; <[email-masked]>
Sent: Thursday, March 17, 2005 10:22 AM
Subject: RE: [Mipshop] MIPSHOP discussion on new items and milestones

> Jari,
> I agree with Vijay. AAA is the most widely deployed authentication
mechanism today in many networks (enterprises use it for remote access VPNs,
providers use it for network access, etc.). It seems useful to take a look
at how to leverage this for deriving handover keys.
> in some networks, where there is access network authentication using AAA
access, it might make sense to setup keys for securing FBU along with access
authentication. so, I think we should take a look at this solution too.

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 17 Mar 2005 11:11:10 -0800

hi Jim,

> provide security with minimal impact on optimization.

not doing key derivation involving multiple hops in the middle
of a handover should be a requirement in any AAA based solution.
I am sure people have taken this into consideration.

Vijay

>>It seems to especially make sense when mip6 is also considering AAA-based
> 
> mechanisms for bootstrapping MNs.
> 
>>Until PKI becomes more prevalent, I think we will be stuck supporting
> 
> AAA-based key derivation.
> 
>>Vidya
>>
>>From: [email-masked] [mailto:[email-masked]] On Behalf
> 
> Of Vijay Devarapalli
>