Subject: [Dime] HA-to-AAAH/need for a auth. token ?

From: Julien Bournelle <[email-masked]>
Date: Fri, 6 Oct 2006 12:39:20 +0200

Hi all,

   I start a new thread on the auth. token issue.

   The issue is to know if the AAA-MIP6 needs a way to know 
   if the MN has been authenticated by the AAA-EAP before
   authorizing (or not) the mip6 service. One way to do this 
   could be to add a "token" in the authorization request. This
   token would be a proof that the MN has been correctly
   authenticated.

   However, as noted by Monica, the AUTH payload in the IKEv2
   exchange is computed by relying on the EAP keying. So, the 
   HA can't compute the AUTH payload if it does not authenticate
   the MN with 4072. If it can't compute this AUTH payload, IPsec SAs
   won't be setup between the MN and HA and thus the mip6 service
   can't be offered.

   This is just a first step in the analysis but it seems that we
   finally not need such a token mechanism.

   Any comments on this ?

   Julien

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 9 Oct 2006 21:24:55 -0400

Julien,

Authorization token is intended for use among NAS/HA, authentication
server and authorization server.  The token is totally transparent to
MN.  Thus, I don't understand linkage between authorization token and
IKEv2 AUTH payload stuff.  Can you elaborate?

Yoshihiro Ohba

---

From: "Julien Bournelle" <[email-masked]>
Date: Tue, 10 Oct 2006 10:59:25 +0200

hi yoshi,

 basically the question was: does the AAA-MIP6 need to know that the
MN has been authenticated by AAA-EAP ?
 Then, as we are separating Authentication from Authorization and
Accounting, we may have think that it was not necessary. But madjid
said that the HA could be compromised and thus the HA could bypass
authentication.

 But, the new question is: is it a realistic scenario since we are
using IKEv2 and that the HA must contact the AAA-EAP to get the key
for AUTH payload computation.

 regards,

 Julien

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 11 Oct 2006 09:43:58 -0400

Julien,

> for AUTH payload computation.

A compromized HA may contact to attacker's AAA-EAP instead of
legitimate AAA-EAP (in this case MN has an account on attacker's
AAA-EAP) or may run IKEv2 without EAP, and then contact to AAA-MIP6 to
obtain MIPv6 parameters.  AAA-MIP6 may not want to give MIPv6
parameters without knowing how and to whom the MN authenticated.

Yoshihiro Ohba