Re: [Dots] another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?

OK!

The reason why I need the clarification is that the line in Section 9 "Also, DOTS gateway and DOTS server MUST perform mutual authentication using certificates." is confusing.
I feel it is needed to be clarified in the signal channel draft or the new draft that in which case the certificates are mandatory.
I think that is the case DOTS agents are in the different domain.

thanks,
kaname

On 2017/09/29 13:22, Konda, Tirumaleswar Reddy wrote:
>
> The signal channel draft does not mandate certificates for mutual authentication (Using an AAA server is only an example deployment). DOTS agents in the same domain can use other mechanisms like TLS-PSK and SPKI. Andrew and I am planning put up a draft on DOTS provisioning.
>
> -Tiru
>
> *From:*Dots [mailto:dots-bounces@ietf.org] *On Behalf Of *kaname nishizuka
> *Sent:* Friday, September 29, 2017 6:02 AM
> *To:* Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>; Xialiang (Frank) <frank.xialiang@huawei.com>; Dots@ietf.org
> *Subject:* Re: [Dots] another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?
>
> Hi Tiru,
>
> in section 9 of signal-channel draft, AAA server exists.
> Let me clarify the text.
>
> Mutual authentication between a DOTS client and a DOTS gateway MUST use (client) certificates?
> Between them (in the same domain), a mutual authentication without certificates (i.e. choices other than EAP-TLS) would be a good option, if it meets the mutual authentication and encryption requirement.
>
> TLS-PSK mode and Subject Public Key Info (SPKI)  looks good to me.
>
> I hope those options would be discussed in WGmeeting.
>
>
> On 2017/08/07 19:19, Konda, Tirumaleswar Reddy wrote:
>
>     You may want to look into https://tools.ietf.org/html/rfc6959#section-7 <https://tools.ietf.org/html/rfc6959#section-7>
>
>     <snip>
>
>        Even if every Internet-connected network implements source address
>
>     validation at the ultimate network ingress, and assurances exist that
>
>     intermediate devices are to never modify datagram source addresses,
>
>     source addresses cannot be used as an authentication mechanism.
>
>     -Tiru
>
>     *From:*Xialiang (Frank) [mailto:frank.xialiang@huawei.com]
>     *Sent:* Monday, August 7, 2017 3:28 PM
>     *To:* Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com> <mailto:TirumaleswarReddy_Konda@McAfee.com>; Dots@ietf.org <mailto:Dots@ietf.org>
>     *Subject:* 答复: another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?
>
>     Hi Tiru,
>
>     Thanks for your analysis. It makes sense to me~~
>
>     To be accurate, IP whitelist does not relax the mutual authentication requirement, but indeed lose the encryption benefits.
>
>     B.R.
>
>     Frank
>
>     *发件人**:*Konda, Tirumaleswar Reddy [mailto:TirumaleswarReddy_Konda@McAfee.com]
>     *发送时间:* 2017年8月7日 17:51
>     *收件人:* Xialiang (Frank); Dots@ietf.org <mailto:Dots@ietf.org>
>     *主题:* RE: another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?
>
>     TLS supports pre-shared key based authentication. The other mechanisms are Subject Public Key Info (SPKI) Fingerprint pin set for mutual authentication (self-signed certificates or raw public keys) without having to deal with CA.
>
>     I don’t think DOTS should relax the mutual authentication and encryption requirements.
>
>     -TIru
>
>     *From:*Dots [mailto:dots-bounces@ietf.org] *On Behalf Of *Xialiang (Frank)
>     *Sent:* Monday, August 7, 2017 6:25 AM
>     *To:* Dots@ietf.org <mailto:Dots@ietf.org>
>     *Subject:* [Dots] another option://答复: Can DOTS protocol support IP whitelist for DOTS client's AA?
>
>     In addition to IP whitelist and certificate, pre-share key can also be an option.
>
>     Right?
>
>     *发件人**:*Dots [mailto:dots-bounces@ietf.org] *代表 *Xialiang (Frank)
>     *发送时间:* 2017年8月7日 8:52
>     *收件人:* Dots@ietf.org <mailto:Dots@ietf.org>
>     *主题:* [Dots] Can DOTS protocol support IP whitelist for DOTS client's AA?
>
>     Hi,
>
>     I think the direct use of IP whitelist on the DOTS server to authenticate and authorize the DOTS client is a simple and effect method, at least in some special use cases, like: DOTS client does not support certificate, an ISP which detects the spoofed source address, etc.
>
>     So, should we support this as an optional way for the DOTS client’s AA and add it into the DOTS protocol drafts?
>
>     B.R.
>
>     Frank
>
>
>
>
>     _______________________________________________
>
>     Dots mailing list
>
>     Dots@ietf.org <mailto:Dots@ietf.org>
>
>     https://www.ietf.org/mailman/listinfo/dots
>