Subject: [AAA-WG]: Why does AAAF generate keys when HA is in a foreign domain?

From: Mark Eklund <[email-masked]>
Date: Thu, 25 Oct 2001 13:20:17 -0400 (EDT)

All,

I just sent out an issue, "ISSUE: MIP-FA-to-HA being added to the AMA
by the AAAF" that deals with the fact that when the HA is in the
foreign domain, the AAAF generates the FA-to-HA keys.  I'm just
curious what keeps us from being consistent and always having the AAAH
generate the keys.

Is there a problem with the AAAH knowing what the FA-to-HA key for
that session will be?  What kind of security issues would this create?

-mark

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 25 Oct 2001 19:26:23 -0700

Why should the AAAH be aware of keys between nodes in another network? Just
so that it can hack them? I know for a fact that the security ADs would have
serious security concerns about someone not involved in the transactions,
and in another domain, be involved in key generation when it shouldn't.

PatC

---

From: Mark Eklund <[email-masked]>
Date: Fri, 26 Oct 2001 10:08:52 -0400

Pat,

 > Why should the AAAH be aware of keys between nodes in another network? Just

I'm just trying to find a viable alternative to the AAAF having to
cache the key it generated when it received a HAR until it receives an
AMR.

 > so that it can hack them? I know for a fact that the security ADs would have

The AAAH is already aware of the MN-FA key and the MN-HA key.  I'm just
trying to determine what security risk also knowing the FA-HA key
would be.  This key will only be associated with that one session
associated with that mobile node.

I guess if the AAAH has access to all the keys and can break into the
foreign domain, and sniff the data transfer between the HA and the FA,
it could then listen to everything said by the mobile node.

So if listening in on the MN traffic when the MN is in the foreign
domain is a worry, we definitely should not allow the AAAH to have
access to the HA-FA key.

Remember though that when the HA is in the foreign domain, the AAAF
will have all keys, so it can listen in on the conversation.  When the
HA is in the home domain, the AAAH wil have access to all the keys and
it can also listen in on the conversation.

Is there something else that could be revealed in the HA-FA
conversation that needs to be protected?

-mark

---

From: "Bob Kopacz" <[email-masked]>
Date: Mon, 29 Oct 2001 07:57:22 -0500

Hi,

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Pat Calhoun
> Sent: Thursday, October 25, 2001 10:26 PM
> To: Mark Eklund
> Cc: [email-masked]
> Subject: Re: [AAA-WG]: Why does AAAF generate keys when HA is in a
> foreign domain?
> 

Technically speaking, in this case the AAAH knows the other two keys 
(ha/mn, fa/mn), even though the parties using these keys are in 
the other domain.  

And the AAAH always knows the mn-fa key, even though mn-fa transactions
are always in the other domain, no matter where the HA lives.

Not suggesting this is wrong or could be avoided, just an observation.