Re: [Dots] another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?

Hi Tiru,

in section 9 of signal-channel draft, AAA server exists.
Let me clarify the text.

Mutual authentication between a DOTS client and a DOTS gateway MUST use (client) certificates?
Between them (in the same domain), a mutual authentication without certificates (i.e. choices other than EAP-TLS) would be a good option, if it meets the mutual authentication and encryption requirement.

TLS-PSK mode and Subject Public Key Info (SPKI)  looks good to me.

I hope those options would be discussed in WGmeeting.

On 2017/08/07 19:19, Konda, Tirumaleswar Reddy wrote:
>
> You may want to look into https://tools.ietf.org/html/rfc6959#section-7 <https://tools.ietf.org/html/rfc6959#section-7>
>
> <snip>
>
>    Even if every Internet-connected network implements source address
>
> validation at the ultimate network ingress, and assurances exist that
>
> intermediate devices are to never modify datagram source addresses,
>
>    source addresses cannot be used as an authentication mechanism.
>
> -Tiru
>
> *From:*Xialiang (Frank) [mailto:frank.xialiang@huawei.com]
> *Sent:* Monday, August 7, 2017 3:28 PM
> *To:* Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>; Dots@ietf.org
> *Subject:* 答复: another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?
>
> Hi Tiru,
>
> Thanks for your analysis. It makes sense to me~~
>
> To be accurate, IP whitelist does not relax the mutual authentication requirement, but indeed lose the encryption benefits.
>
> B.R.
>
> Frank
>
> *发件人**:*Konda, Tirumaleswar Reddy [mailto:TirumaleswarReddy_Konda@McAfee.com]
> *发送时间:* 2017年8月7日 17:51
> *收件人:* Xialiang (Frank); Dots@ietf.org <mailto:Dots@ietf.org>
> *主题:* RE: another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?
>
> TLS supports pre-shared key based authentication. The other mechanisms are Subject Public Key Info (SPKI) Fingerprint pin set for mutual authentication (self-signed certificates or raw public keys) without having to deal with CA.
>
> I don’t think DOTS should relax the mutual authentication and encryption requirements.
>
> -TIru
>
> *From:*Dots [mailto:dots-bounces@ietf.org] *On Behalf Of *Xialiang (Frank)
> *Sent:* Monday, August 7, 2017 6:25 AM
> *To:* Dots@ietf.org <mailto:Dots@ietf.org>
> *Subject:* [Dots] another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?
>
> In addition to IP whitelist and certificate, pre-share key can also be an option.
>
> Right?
>
> *发件人**:*Dots [mailto:dots-bounces@ietf.org] *代表 *Xialiang (Frank)
> *发送时间:* 2017年8月7日 8:52
> *收件人:* Dots@ietf.org <mailto:Dots@ietf.org>
> *主题:* [Dots] Can DOTS protocol support IP whitelist for DOTS client's AA?
>
> Hi,
>
> I think the direct use of IP whitelist on the DOTS server to authenticate and authorize the DOTS client is a simple and effect method, at least in some special use cases, like: DOTS client does not support certificate, an ISP which detects the spoofed source address, etc.
>
> So, should we support this as an optional way for the DOTS client’s AA and add it into the DOTS protocol drafts?
>
> B.R.
>
> Frank
>
>
>
> _______________________________________________
> Dots mailing list
> Dots@ietf.org
> https://www.ietf.org/mailman/listinfo/dots