Subject: [proxies] New Version Notification for draft-hoeper-proxythreat-02

From: "Hoeper Katrin-QWKN37" <[email-masked]>
Date: Mon, 9 Mar 2009 10:49:46 -0400

Hi everybody,

A new version of the proxy draft has been posted and is available at
http://www.ietf.org/internet-drafts/draft-hoeper-proxythreat-02.txt.

The new version attempts to address most comments that have been
previously posted to this list and some of the discussions at IETF 73.
One major difference is that the new draft describes current practices
that mitigate some of the identified threats by proxies.

I won't be able to continue as an editor and Stefan Winter agreed to act
as the new editor of the draft. Stefan will also replace me as the
moderator of the proxy email list. Thank you Stefan!

Please read the new draft and provide your comments or even better
provide some text to Stefan and become a co-author. Much work remains to
be done and volunteers are needed, especially if the draft should be
formed into a "best practices" document.

Best regards,
Katrin

-----Original Message-----
From: IETF I-D Submission Tool [mailto:[email-masked]] 
Sent: Monday, March 09, 2009 9:35 AM
To: Hoeper Katrin-QWKN37
Cc: [email-masked]
Subject: New Version Notification for draft-hoeper-proxythreat-02 

A new version of I-D, draft-hoeper-proxythreat-02.txt has been
successfuly submitted by Katrin Hoeper and posted to the IETF
repository.

Filename:	 draft-hoeper-proxythreat
Revision:	 02
Title:		 Threat Model for Networks Employing AAA Proxies
Creation_date:	 2009-03-09
WG ID:		 Independent Submission
Number_of_pages: 23

Abstract:
This memo defines a threat model for access networks with AAA
proxies.  Use cases of current and future applications in which AAA
proxies are employed are described and it is discussed how proxies
could launch attacks in the defined use cases.  The risk associated
with these attacks in each use case is analyzed.  In addition,
mitigation techniques used in current AAA deployments are discussed
and best practices for mitigating the identified attacks are
identified.  As a result, this draft can serve as a guideline for
risk assessments and problem mitigation by providers, implementers
and protocol designers of systems with proxies.

The IETF Secretariat.

---

From: Stefan Winter <[email-masked]>
Date: Tue, 10 Mar 2009 11:05:00 +0100

Hi Katrin,

> that mitigate some of the identified threats by proxies.

Thanks for your efforts! Interestingly, the stub sections about eduroam
et al. in your draft coincides nicely with Klaas' wish about describing
existing deployments. Of course there is still text missing for those
stubs. As soon as my time permits, I will flesh out the eduroam parts.
Input from others and their current problem mitigation approaches is
most welcome!

> moderator of the proxy email list. Thank you Stefan!

Thank you for getting the draft up to this point.

> formed into a "best practices" document.

Amen!

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

---

From: Klaas Wierenga <[email-masked]>
Date: Tue, 10 Mar 2009 11:27:10 +0100

Hi Stefan, Karin,

> Input from others and their current problem mitigation approaches is

I am happy to contribute

> Thank you for getting the draft up to this point.

yes, thanks for the effort, not only in writing the draft but also in
getting the proxy group to move forward!

>> formed into a "best practices" document.

Klaas