Subject: [AAA-WG]: RE: Do we need a NAS-Ciphersuite-Capabilities AVP?

From: [email-masked]
Date: Fri, 5 Oct 2001 16:24:39 +0300

> From: ext Glen Zorn [mailto:[email-masked]]

> > If the EAP type is supposed to negotiate the ciphersuite,
> > then I guess we need to specify a new AVP for NAS capabilities.
> 
> This seems like a reasonable idea at first glance, but I have 
> some concerns.
> 
> 1) Since the cryptosystem is being negotiated in EAP and the 
> EAP server and
> Diameter server may likely be distinct entities, this would 
> seem to add
> interface requirements to EAP servers.

That's true. But negotiating cryptosystems in EAP will require 
interfaces between EAP and Diameter anyway. The result
of the negotiation will have to be passed from the EAP server
to the Diameter server, and from the Diameter client to 
the packet security subsystem of the NAS.

> 2) EAP should probably not be allowed to negotiate just any 
> cryptosystem it
> likes: there seems to be an authorization issue as well.  For example,
> suppose that EAP negotiates 40-bit RC4 but the user is only allowed to
> connect using 128-bit AES.  How would this restriction be enforced?

I don't think that knowing the NAS ciphersuite capabilities has 
to stop the Diameter server from enforcing this restriction.
It could always say Access-Reject. Or it could filter out any
undesired ciphersuites from the NAS-Ciphersuite-Capabilities
AVP before giving them to the EAP server.

Ideally, all the entities (the client, the NAS and the AAA server)
should be able to have their own policies. It is conceivable that 
40-bit RC4 could be fine for the everyone but everyone would prefer 
128-bit AES. In this case, the network entity that negotiates 
the cryptosystem needs to know the capabilities of the NAS.

> Both these concerns seem to suggest that EAP cannot be treated 
> simply as a "pass-through" any more...

Unless the cryptosystem is negotiated between the client and the NAS.
Authorization issues could still be handled with a Diameter AVP.

Regards,
Henry