Subject: [AAA-WG]: Do we need a NAS-Ciphersuite-Capabilities AVP?

From: [email-masked]
Date: Wed, 3 Oct 2001 14:20:15 +0300

Hi all,

This e-mail is related to issue #188 and the discussion
at the following URLs:
http://www.merit.edu/mail.archives/aaa-wg/msg02211.html
http://www.merit.edu/mail.archives/aaa-wg/msg02237.html

There is demand for enabling ciphersuite negotiation within 
EAP. The result of the negotiation (the selected ciphersuite) 
can already be transported to the NAS in the NAS-Key-Binding 
AVP. But there is no AVP to transport the NAS capabilities to 
the AAA server.

If the EAP type is supposed to negotiate the ciphersuite, 
then I guess we need to specify a new AVP for NAS capabilities.
For example, a NAS-Ciphersuite-Capabilities AVP could be included 
in the first Diameter-EAP-Request sent by the Diameter client.
The AVP would list the ciphersuites supported by the NAS. Ideally,
the same ciphersuite numbering space should be used in the AVP and 
in the NAS-Key-Binding AVP.

Should I file an issue?

Regards,
Henry

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 3 Oct 2001 11:23:07 -0700

> in the NAS-Key-Binding AVP.

This seems like a reasonable idea at first glance, but I have some concerns.

1) Since the cryptosystem is being negotiated in EAP and the EAP server and
Diameter server may likely be distinct entities, this would seem to add
interface requirements to EAP servers.

2) EAP should probably not be allowed to negotiate just any cryptosystem it
likes: there seems to be an authorization issue as well.  For example,
suppose that EAP negotiates 40-bit RC4 but the user is only allowed to
connect using 128-bit AES.  How would this restriction be enforced?

Both these concerns seem to suggest that EAP cannot be treated simply as a
"pass-through" any more...