Re: [HOKEY] ERX issues

Versions of the text should probably be in both the key management 
document and also ERX.  The key management document should discuss fraud 
issues of delivering a DSRK to a domain without authorization, and 
indicate that performing a full EAP authentication or ERX bootstrap 
would address this issue.  I think there should still be some reference 
to this within the ERX document as well.

Tim, would you support adding such text to the document?

I'll work on proposed text...

--
t. charles clancy, ph.d.                 eng.umd.edu/~tcc
electrical & computer engineering, university of maryland

Lakshminath Dondeti wrote:
> On 3/17/2008 5:06 PM, Charles Clancy wrote:
>> During IESG evaluation, and at the last WG meeting, the following 
>> points were raised.  I've opened issues to track their progress:
>>
>> ERX: authorization attack
>> http://www.ltsnet.net:8080/hokey/issue43
>>
>> ERX document needs text defining behavior when re-authing across AAA 
>> DNS domains, and relate that to key management domains and 
>> administrative domains.  As-is, a re-auth across DNS domains without 
>> performing an ERP bootstrap results in authorization in a new domain 
>> with no accounting record of an initial authentication.  This could 
>> lead to fraudulent charges across AAA domains.
> 
> Any proposed text?  If the domain name changes, there would be a new 
> domain specific key.  Why wouldn't we write in the AAA document that 
> upon ERP bootstrapping, there should be accounting start or equivalent? 
>  In fact, that is what I thought should happen with no changes to ERX.
> 
> Next, procedurally, I haven't seen any AD picking this up as a DISCUSS, 
> so I guess we are doing due diligence as part of the WG process and 
> presumably Tim would support such a change.  Could we make sure that 
> this is ok with him?
> 
>>
>>
>> ERX: lower layer support
>> http://www.ltsnet.net:8080/hokey/issue44
>>
>>  From Jari's DISCUSS.  ERX needs "truth in advertising" with respect 
>> to how existing authenticators may deal with a new EAP code.  See:
>> https://datatracker.ietf.org/idtracker/draft-ietf-hokey-erx/comment/78738/ 
>>
>>
> 
> I like Glen's take on this.  Ideally, this should require no text 
> changes.  Jari thinks otherwise.
> 
> regards,
> Lakshminath
_______________________________________________
HOKEY mailing list
HOKEY@ietf.org
https://www.ietf.org/mailman/listinfo/hokey