Re: [proxies] Review of draft-hoeper-proxythreat-01.txt (Part 1)

> Fair points, but aren't you than essentially saying "forget about the 
> threats and write *only* a deployment draft"?

The document doesn't cite some existing threat model assessments,
including RFC 5247 which is standards track and was chartered for
this purpose.  So I'd say that a new threat model document (if it
is needed) should focus on what is missing or what has 
changed with respect to those prior assessments.

One thing that has changed is RADSEC.  RADSEC challenges may of the 
assumptions that have been made relating to RADIUS, such as:

         RADIUS clients and servers cannot support certificates
         RADIUS cannot support confidentiality
         RADIUS requires a "trapezoid" model similar to SIP
         RADIUS clients cannot handle DNS lookups
         Proxy-avoidance technologies such as Diameter "redirect" cannot be deployed
         Large scale roaming between many domains is very difficult to set up

Once these assumptions become invalid, many of the security threats/issues also
disappear, and new ones may appear in their place.  In particular, given that
EDUROAM is virtually the only large scale deployed instance of inter-domain key 
transport, it probably makes sense to focus on it, rather than analyzing the 
security risks of other (nonexistent) deployments such as WiMAX. 

For example, if we start with the analysis of the operational benefits

of proxies described in RFC 2607, we find that several of the benefits
don't exist with RADSEC:
1.   Scalability improvement
2,   Authentication forwarding
3.   Capabilities adjustment
4.   Policy implementation
5.   Accounting reliability improvement
6.   Atomic operation

Of these benefits, at least #1 and #2 is no longer 
required with RADSEC using certificates.  Do benefits
#3, 4, 5 or 6 occur in a network such as EDUROAM?