Subject: RE: [Seamoby] My thoughts on server approaches (and other fun stuff)

From: [email-masked]
Date: Wed, 19 Mar 2003 16:47:27 -0500

Hi:

CARD server is logical entity (a piece of software and IANA assigned UDP number) which can be put on any box. Security mechanism for AR-server exchange can be of operator's choice, e.g., if this box has IPSec stack and ARs have IPSec stack and they have configured credentials (passwords) it can use IPSec. 

In summary, I too am not convinced about tying CARD to AAA. I also don't get the argument that AAA servers make security readily available. If someone has an enterprise network that does not use AAA (Diameter server to be precise), but has Kerberos, for this person security is readily available in the form of Kerberos rather than Diameter.

Hemant 

-----Original Message-----
From: ext Pat Calhoun [mailto:[email-masked]]
Sent: Wednesday, March 19, 2003 12:56 PM
To: Singh Ajoy-ASINGH1
Cc: [email-masked]
Subject: RE: [Seamoby] My thoughts on server approaches (and other fun
stuff)

> Regarding the one question I can answer:
> AJOY-> I did not follow this. If CARD function is extension of 
> > AAA function then why we need SA between embedded device and 
> > AAA server. 
> 
> exactly, if it's an extension to an AAA protocol, every AAA protocol that I
> know requires some form of security relationship in order to communicate in 
> a secure fashion, either via shared secrets, or certs. So there's security
> configuration required regardless of the approach.
> 
> AJOY-> I do agree the AR will require some SA with AAA server. But such security
> should be readily available when AAA is  being used in access network.

ok... fair enough. So my question to the WG is whether it is a
reasonable assumption that everyone will deploy AAA servers for
mobility. If so, maybe it's a safe assumption, but I'm not convinced.

PatC

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby
_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: Pat Calhoun <[email-masked]>
Date: 19 Mar 2003 16:11:06 -0800

> In summary, I too am not convinced about tying CARD to AAA. I also 
> don't get the argument that AAA servers make security readily 
> available. If someone has an enterprise network that does not use AAA
> (Diameter server to be precise), but has Kerberos, for this person
> security is readily available in the form of Kerberos rather than 
> Diameter.
> 
This is my point. Security is mandatory, of course, but I really don't understand why it has to be a separate physical entity. It complicates deployments, and doesn't allow one to build a single box solution.

PatC

---

From: Pat Calhoun <[email-masked]>
Date: 19 Mar 2003 16:11:06 -0800

PatC