Re: [HOKEY] ERX issues

On Mon, Mar 17, 2008 at 07:45:10PM -0700, Lakshminath Dondeti wrote:
> On 3/17/2008 5:06 PM, Charles Clancy wrote:
> > During IESG evaluation, and at the last WG meeting, the following points 
> > were raised.  I've opened issues to track their progress:
> > 
> > ERX: authorization attack
> > http://www.ltsnet.net:8080/hokey/issue43
> > 
> > ERX document needs text defining behavior when re-authing across AAA DNS 
> > domains, and relate that to key management domains and administrative 
> > domains.  As-is, a re-auth across DNS domains without performing an ERP 
> > bootstrap results in authorization in a new domain with no accounting 
> > record of an initial authentication.  This could lead to fraudulent 
> > charges across AAA domains.

I don't think this captures the problem well.  The problem in my
understanding is that a visiting AAA proxy can request a DSRK even if
the peer did not request it.  As a result, the visited domain can make
extra charge regarding the use of ERX optimization, and the home
domain does not have any evidence about the peer had ever agreed with
use of ERX in the visited domain or requested a DSRK.  I don't
understand how accounting record of an initial authentication can
solve the problem.  The accounting record can show that an initial
authentication happened in the visited domain, but it does not carry
anything about peer consent on the use of ERX with DSRK.

Yoshihiro Ohba

> 
> Any proposed text?  If the domain name changes, there would be a new 
> domain specific key.  Why wouldn't we write in the AAA document that 
> upon ERP bootstrapping, there should be accounting start or equivalent? 
>   In fact, that is what I thought should happen with no changes to ERX.
> 
> Next, procedurally, I haven't seen any AD picking this up as a DISCUSS, 
> so I guess we are doing due diligence as part of the WG process and 
> presumably Tim would support such a change.  Could we make sure that 
> this is ok with him?
> 
> > 
> > 
> > ERX: lower layer support
> > http://www.ltsnet.net:8080/hokey/issue44
> > 
> >  From Jari's DISCUSS.  ERX needs "truth in advertising" with respect to 
> > how existing authenticators may deal with a new EAP code.  See:
> > https://datatracker.ietf.org/idtracker/draft-ietf-hokey-erx/comment/78738/
> > 
> 
> I like Glen's take on this.  Ideally, this should require no text 
> changes.  Jari thinks otherwise.
> 
> regards,
> Lakshminath
> _______________________________________________
> HOKEY mailing list
> HOKEY@ietf.org
> https://www.ietf.org/mailman/listinfo/hokey
> 
_______________________________________________
HOKEY mailing list
HOKEY@ietf.org
https://www.ietf.org/mailman/listinfo/hokey