Re: [proxies] [IETF Proxy] Next Steps

  Hi Stefan,

On Thu, April 17, 2008 6:50 am, Stefan Winter wrote:
[snip]
> To me, the above model seems to have two role models of proxies:
>
> - the "technical" proxy - to aggregate or channelize traffic for
> managability
> reasons
> - the "political" proxy - due to the requirement or wish to inspect,
> control
> or modify traffic while in flight
>
> The first kind might go away with dynamic discovery between service
> provider
> and home server; the second might most certainly not. So my answer to the
> proxy problem in general is: we will have to live with them.

  This political proxy thing concerns me. The only traffic that a AAA proxy
could inspect, control or modify is AAA traffic. So what this entity would
do is glean information about who is using what network where and, in
some cases, prevent some people somewhere from using some network.

  These are not things that I think we _have_ to deal with especially in
a technical forum. These are issues that a customer will require a vendor
of AAA product to support, in much the same way that "lawful intercept"
is a political add-on to a technical solution-- e.g. the IPsec WG did not
architect "lawful intercept" into RFC2401 but people that have implemented
IPsec have added backdoors into their products to allow for it. I'm sure
that some RFP somewhere will mandate, if it doesn't already, that
evesdropping and controlling entities be required in between AAA client
and AAA server but that isn't really the problemspace we're dealing with.

  I have heard many other reasons why AAA proxies must exist. If a magic
wand made all those reasons disappear I really hope this political
justification would not keep them around. (Note: I'm not entertaining the
notion of getting rid of proxies, just theorizing, so don't attack me).

  This does highlight threats though. It's not just that proxies can
listen to AAA exchanges, they can glean information out of AAA exchanges,
and they can constrain or deny service that should otherwise be
unconstrained or allowed.

  Dan.

_______________________________________________
Proxies mailing list
Proxies@ietf.org
https://www.ietf.org/mailman/listinfo/proxies