Re: [6tisch] [6tisch-security] proposed security text for architecture draft

[<[e-mail]>]

Michael,

Use of EAP-TLS and terminating TLS session at AAA server does not mean that all parameters have to be coming from AAA server.  Especially when PANA is used, PAA can be co-located with JCE and provide 6top data over a secure PANA SA.  Actually this model applies to any EAP method.

Also, use of PANA with relay function neither requires a routable solution such as loose source routing to convey authentication message between JCE and JN nor requires a per-JN state on JA.

Regards,
Yoshihiro Ohba


-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Michael Richardson
Sent: Friday, November 14, 2014 12:07 PM
To: ohba yoshihiro(大場 義洋 ○ＲＤＣ□ＮＳＬ)
Cc: [e-mail]; [e-mail]
Subject: Re: [6tisch] [6tisch-security] proposed security text for architecture draft


{Please note that I am very familiar with EAP mechanisms, and I wrote EAP-SIM  for Freeradius a decade ago, when the document was going through many changes}

<[e-mail]> wrote:
    > Regarding EAP method, I mentioned EAP-TLS.  EAP-TLS works for both
    > certificate-based authentication and pre-shared key based
    > authentication (EAP-TLS-PSK) without EAP tunneling method such as
    > EAP-TTLS.  In the latter case, TLS session is typically terminated at
    > AAA server.

But, since the EAP-TLS session terminates at the the AAA server, all of the communications that we want to do (the 6top data), would have to come from
the AAA server.   

That means installing all of 6top/DTLS/CoAP code into the radius server.  
(That's because the EAP-TLS is between AAA(radius) server and joining node) Is that really what you want to do?

What other things would the AAA server provide to the joining node?
Are you thinking about various kinds of group policies, etc?

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [