Subject: RE: [Mipshop] MIPSHOP discussion on new items and milestones

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Thu, 17 Mar 2005 12:28:34 -0600

Jari,
I am not sure if this is true. I think we need to support AAA-based key derivation mainly because not everyone has deployed a PKI, while AAA infrastructure has been widely deployed. 3gpp2 relies a lot on AAA and so, there seems to be enough demand for a AAA-based solution. 

More than any technical advantages of a AAA-based approach, it seems to me that the main advantage is in leveraging existing infrastructure. 

Vidya

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jari Arkko
Sent: Thursday, March 17, 2005 12:18 PM
To: Vijay Devarapalli
Cc: gabriel montenegro; [email-masked]
Subject: Re: [Mipshop] MIPSHOP discussion on new items and milestones

Vijay Devarapalli wrote:

>>- MN-AR security is a significant issue in current specifications, and 
>>as such addressing it would be really useful. But I wonder about the 
>>need to have two different solutions in this space. Seems like James' 
>>draft would technically work in all scenarios. What he said about the 
>>IPR sounded positive too (but I am not a lawyer nor have I looked at 
>>the relevant patents).
>>    
>>
>
>in some networks, where there is access network authentication using 
>AAA access, it might make sense to setup keys for securing FBU along 
>with access authentication. so, I think we should take a look at this 
>solution too.
>  
>
Maybe. But only if the other solution has a drawback
that the AAA based solution could fix, such as better efficiency, higher security, or ability of service providers to get additional money. Is there such an advantage? (If the solutions are similar from the user's point of view, I don't think we need several solutions.)

--Jari

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: Jari Arkko <[email-masked]>
Date: Thu, 17 Mar 2005 20:49:37 +0200

>More than any technical advantages of a AAA-based approach, it seems to me that the main advantage is in leveraging existing infrastructure. 
I agree with your arguments against PKI-based solutions. But where
did PKI come from? I don't see a proposal on the table that is based
on PKI. James' draft is not based on PKI. In fact, its based on completely
zero-config security so it could run on any network, if I have understood
correctly.

Note that I'm not trying to argue in favor of James' solution. I'm
just reacting to the notion that we need multiple handover key
solutions. Of course, we could have a situation where they have
very different characteristics that lead to a requirement that
we need to do both (e.g. AAA is very fast and James' draft is
zero-config). Or that they are complementary in the same manner
as home test and care-of test optimizations are in RR. But so
far I have not seen anything that tells me this would be the case.

Lets document the different user impacts that demand two
mechanisms, if there are any in this case. Otherwise lets just
do one scheme, either AAA or James' thing.

--Jari