Re: [Dime] Quick look at draft-ietf-dime-ikev2-psk-diameter-00.txt

Hi Hannes,

Comment 1 is okay.  We will reword etc..

Comment 2 we will look at the draft.  Hopefully it will be ready before we are ready. The usual problem.  So we will start with resusing the appropriate AVPs then if there are issue we will go to some other plan B.

Comment 3

3) Security

The security in the document is a bit fuzzy to me. I believe what you are saying is essentially that the pre-shared key isn't really the user's long-term shared key but rather something that has been dynamically established (and thus short lived) based on a previous network access authentication run (or something like that). Is my understanding correct?

Avi;  Yes

In any case, I believe it would be helpful to go through the Housley criteria as a guide for the text that one might want to find in the security consideration sections of such a document. This helps to point out some security threats in a more structured fashion. Does this make sense to you?

Avi:  I agree.  We will do that.

On 14-01-2010, at 17:15 , Tschofenig, Hannes (NSN - FI/Espoo) wrote:

Hi Avi,

I have three comments at this point in time:

1) Editorial

There is some room for improvement on the editorial side. An example:

FROM:

Abstract

   Internet Key Exchange is a component of IPsec used for performing
   mutual authentication as well as establishing and maintaining
   security associations (SAs) between two parties such as a user and a
   network entity.  Internet Key Exchange v2 (IKEv2) protocol allows
   several different mechanisms for authenticating a user, namely the
   Extensible Authentication Protocol, certificates, and pre-shared
   secrets.  To authenticate and/or authorize the user, the network
   element such as the Access Gateway may need to dynamically bootstrap
   a security association based on interaction with the Diameter server.
   This document specifies the interaction between the Access Gateway
   and Diameter server for the IKEv2 based on pre-shared secrets.

TO:

"
Abstract

   The Internet Key Exchange protocol version 2 (IKEv2) is a component of
   the IPsec architecture and used to perform mutual authentication as well
   as to establish and to maintain IPsec security associations (SAs) between
   the respective parties. IKEv2 supports several different authentication
   mechanisms, such as the Extensible Authentication Protocol (EAP),
   certificates, and pre-shared secrets.

   With TBD-RFC the Diameter interworking for Mobile IPv6 between the Home
   Agent, as a Diameter client, and the Diameter server has been specified.
   However, that specification focused on the usage of EAP and did not
   include support for pre-shared secret based authentication available
   with IKEv2. This document therefore extends the functionality offered
   by TBD-RFC with pre-shared key based authentication offered by IKEv2
   when no EAP is used.
"

2) Reuse of draft-ietf-dime-local-keytran-00.txt

Instead of defining your own key related AVP wouldn't it make sense to reuse what has been defined in http://www.ietf.org/id/draft-ietf-dime-local-keytran-00.txt ?

3) Security

The security in the document is a bit fuzzy to me. I believe what you are saying is essentially that the pre-shared key isn't really the user's long-term shared key but rather something that has been dynamically established (and thus short lived) based on a previous network access authentication run (or something like that). Is my understanding correct?

In any case, I believe it would be helpful to go through the Housley criteria as a guide for the text that one might want to find in the security consideration sections of such a document. This helps to point out some security threats in a more structured fashion. Does this make sense to you?

Ciao
Hannes

_______________________________________________
DiME mailing list
DiME@ietf.org<mailto:DiME@ietf.org>
https://www.ietf.org/mailman/listinfo/dime