Subject: [Dime] Consensus Call regarding Diameter Mobile IPv6 HA-to-AAAH support

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 14 Mar 2007 22:21:48 +0100

Hi all,

with our work on the "Diameter Mobile IPv6  HA-to-AAAH support" document 
(see 
http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-01.txt) 
we defined a new Diameter application and we then decided that we should 
separate the authentication and authorization interaction to avoid an 
update of this specification when RFC 4072 is updated. This means that 
the Diameter MIPv6 app-ID is used for the authorization part and the 
Diameter EAP app-ID is used for the authentication part. Diameter 
routing may cause authentication and authorization messages to be routed 
to different servers. This caused a lengthy debate on security issues. 
It seems that there is a lot of complexity associated with this approach.

I would therefore like to hear whether working group members are OK with 
performing authentication and authorization as part of one Diameter 
application. This would therefore mean that we are going to use the 
Diameter MIPv6 app-ID for authentication and for authorization.

Please state your opinion.

Ciao
Hannes

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Wed, 14 Mar 2007 19:32:43 -0700

Hannes Tschofenig <mailto:[email-masked]> allegedly scribbled
on Wednesday, March 14, 2007 2:22 PM:

> Hi all,
> 
> with our work on the "Diameter Mobile IPv6  HA-to-AAAH support"
> document (see 
> we defined a new Diameter application and we then decided that we
> should separate the authentication and authorization interaction to
> avoid an update of this specification when RFC 4072 is updated. This
> means that the Diameter MIPv6 app-ID is used for the authorization
> part and the Diameter EAP app-ID is used for the authentication part.
> Diameter routing may cause authentication and authorization messages
> to be routed to different servers. This caused a lengthy debate on
> security issues. It seems that there is a lot of complexity
> associated with this approach.       
> 
> I would therefore like to hear whether working group members are OK
> with performing authentication and authorization as part of one
> Diameter application. This would therefore mean that we are going to
> use the Diameter MIPv6 app-ID for authentication and for
> authorization.    

Works for me.

---

From: "Avi Lior" <[email-masked]>
Date: Wed, 14 Mar 2007 23:06:27 -0400

Yes.

Authentication -- the EAP part and Authorization should happen in one
Diameter Application. 

-----Original Message-----
From: Hannes Tschofenig [mailto:[email-masked]] 
Sent: Wednesday, March 14, 2007 5:22 PM
To: [email-masked]
Subject: [Dime] Consensus Call regarding Diameter Mobile IPv6
HA-to-AAAHsupport

Hi all,

It seems that there is a lot of complexity associated with this
approach.

Ciao
Hannes

---

From: Jouni Korhonen <[email-masked]>
Date: Thu, 15 Mar 2007 08:49:01 +0200

Hi,

Hannes Tschofenig kirjoitti:

[snip-sanp]

> Diameter MIPv6 app-ID for authentication and for authorization.

I prefer one application.

Cheers,
	Jouni

---

From: "Gerardo Giaretta" <[email-masked]>
Date: Thu, 15 Mar 2007 09:59:54 +0100

One application is the right approach IMO.

--Gerardo

---

From: "Antonio F. Gómez Skarmeta" <[email-masked]>
Date: Thu, 15 Mar 2007 10:04:33 +0100

> One application is the right approach IMO.

  Agree with Gerardo IMHO

 Antonio

-- 
------------------------------------------------------------
Antonio F. Gómez Skarmeta
Dept. Ingeniería de la Información y las Comunicaciones
Facultad de Informática
Universidad de Murcia
Apartado 4021
30001 Murcia
Telf: +34-968-364607
fax: +34-968-364151

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 15 Mar 2007 10:03:13 +0100

<chair hat off>

Hannes Tschofenig wrote:
> security issues. It seems that there is a lot of complexity associated 
> with this approach.
>
> use the Diameter MIPv6 app-ID for authentication and for authorization.
>

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 15 Mar 2007 14:15:50 -0700

I prefer using one Diameter application.

Vijay

---

From: "Tolga Asveren" <[email-masked]>
Date: Thu, 15 Mar 2007 16:40:27 -0500

I also think one application makes sense. I guess it may be technically
possible to separate authentication and authorization parts to different
applications but it seems reaching a consensus on how to do it would take a
very long time and that it is practically not needed -at least for now-.

   Thanks,
   Tolga

> Sent: Thursday, March 15, 2007 4:03 AM
> To: [email-masked]
> Subject: Re: [Dime] Consensus Call regarding Diameter Mobile IPv6
> HA-to-AAAHsupport
>
>
> <chair hat off>
>

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 15 Mar 2007 17:28:44 -0500

I support.

Regards,
Ahmad

> Sent: Wednesday, March 14, 2007 4:22 PM
> To: [email-masked]
> HA-to-AAAH support
> with our work on the "Diameter Mobile IPv6  HA-to-AAAH 
> support" document (see
> we defined a new Diameter application and we then decided 
> that we should separate the authentication and authorization 
> interaction to avoid an update of this specification when RFC 
> 4072 is updated. This means that the Diameter MIPv6 app-ID is 
> used for the authorization part and the Diameter EAP app-ID 
> is used for the authentication part. Diameter routing may 
> cause authentication and authorization messages to be routed 
> I would therefore like to hear whether working group members 
> are OK with performing authentication and authorization as 
> part of one Diameter application. This would therefore mean 
> that we are going to use the Diameter MIPv6 app-ID for 
> authentication and for authorization.
>

---

From: Victor Fajardo <[email-masked]>
Date: Thu, 15 Mar 2007 19:27:02 -0400

Hi Hannes,

the single app proposal is ok with me.

victor

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 15 Mar 2007 20:34:07 -0400

As I repeatedly mentioned over this mailing list, I strongly believe
that separation of authentication and authorization is the best way to
proceed for MIPv6 HA-to-AAAH in terms of modularity.  I failed to
understand what exactly the actual complexity associated with approach
is.  I also do not understand how people who agree with the combined
authentication and authorization approach can also agree with Diameter
QoS application which is separately defined from authentication.

Finally, I also have an implementation issue with the combined
authentication and authorization approach for Open Diameter in which a
philosophy of "no code duplicate" among different
applications/libraries has been applied in order to avoid a problem
with changing one Diameter application library but forgetting to make
the same change for a similar Diameter application library as much as
possible.  There may be some ugly implementation technique to avoid
code duplicate, which I don't like to see in Open Diameter.

Best Regards,
Yoshihiro Ohba

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 16 Mar 2007 14:48:43 +0100

Hi Yoshi,

Yoshihiro Ohba wrote:
> is.

There is the impression that
a) the separation is not necessary from a deployment point of view and
can be accomplished via other means, and
b) security issues have been raised.

I guess you see no problems with (b) and you don't believe that (a) can
be done.
Right?

>   I also do not understand how people who agree with the combined
For the Diameter QoS work we still need to investigate a number of
discussions. I have asked a few experts to review the work in order to
propose changes, if needed. I am sure that we will see a few changes in
the next few weeks.

> code duplicate, which I don't like to see in Open Diameter.
Isn't that specific to the way how OpenDiameter is implemented rather
than a generic problem?

Ciao
Hannes

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 19 Mar 2007 19:05:52 -0400

> I guess you see no problems with (b) and you don't believe that (a) can

I see no problem with (b).  We discussed a sceanario of compromised
HA, but compromised HA can do anything, so the scenario does not seem
to affect this decision making.  

Regarding (a), it *can* be done, but to me it's just a superficial
idea that is inherited from RADIUS to unnecessarily combine
authentication and authorization.  Lionel mentioned that it's
case-by-case decision, but I would expect a very clear and convincing
guidance as to which set of conditions combination is better than
seperation, which may also affect QoS application discussion.

> Isn't that specific to the way how OpenDiameter is implemented rather

Right.

Yoshihiro Ohba

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Tue, 20 Mar 2007 14:49:16 -0400

Hi all,

I would agree with a single Diameter application for both authentication
and authorization for MIP6 service with IKEv2/IPsec.

In some scenarios, the IPsec gateway (e.g. 3GPP:PDG, 3GPP2:PDIF) may be
collocated with the Home Agent. To support such scenarios, there should
be a clear way to identify the type of service the MN is trying to
access i.e. it is trying to only establish an IPsec session with the
IPsec gateway or it wants to access MIPv6 service as well. The IDr field
in the IKEv2 exchange can be used for this type of service selection. 

So, I would suggest that MIPv6 Diameter application is used when such
(IPsec or IPsec+MIP6) indication is available at the Home Agent.

Best regards,
Kuntal

> From: Avi Lior [mailto:[email-masked]]
> Sent: Wednesday, March 14, 2007 10:06 PM
> To: Hannes Tschofenig; [email-masked]
> Subject: RE: [Dime] Consensus Call regarding Diameter Mobile
IPv6HA-to-
> AAAHsupport
document
> we defined a new Diameter application and we then decided that we
should
> I would therefore like to hear whether working group members are OK
with

---

From: <[email-masked]>
Date: Wed, 21 Mar 2007 10:40:41 +0100

Hi Kuntal,

I would hesitate to 'define' any use of Idr in Dime drafts. Some
text discussing that there are multiple ways of signaling the type
of desired functionality of the IKEv2 gw, whether it is IPSec
or IPSec+MIP6.

Cheers,
	Jouni

> From: Chowdhury, Kuntal [mailto:[email-masked]] 
> Sent: 20. maaliskuuta 2007 20:49
> To: Avi Lior; Hannes Tschofenig; [email-masked]
> Subject: RE: [Dime] Consensus Call regarding Diameter 
> MobileIPv6HA-to-AAAHsupport
> 
> Hi all,
> 
> I would agree with a single Diameter application for both 
> authentication and authorization for MIP6 service with IKEv2/IPsec.
> 
> In some scenarios, the IPsec gateway (e.g. 3GPP:PDG, 
> 3GPP2:PDIF) may be collocated with the Home Agent. To support 
> such scenarios, there should be a clear way to identify the 
> type of service the MN is trying to access i.e. it is trying 
> to only establish an IPsec session with the IPsec gateway or 
> it wants to access MIPv6 service as well. The IDr field in 
> the IKEv2 exchange can be used for this type of service selection. 
> 
> So, I would suggest that MIPv6 Diameter application is used 
> when such (IPsec or IPsec+MIP6) indication is available at 
> the Home Agent.
> 
> Best regards,
> Kuntal
> 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 22 Mar 2007 03:41:13 -0400

> (IPsec or IPsec+MIP6) indication is available at the Home Agent.

I think that separation of authentication and authorization fits
better to this scenario.  Diameter EAP application is used for EAP
over IKEv2 for both cases (IPsec and IPsec+MIP6).  For IPsec+MIP6, you
additionally run Diameter MIP6 application to obtain MIP6 parameters.

Yoshihiro Ohba

---

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Fri, 23 Mar 2007 13:21:26 -0400

Hi Jouni,

The IDr field is one way to indicate whether the MN wants to establish
an IPsec session or it wants to establish IPsec+MIP6 session. At the
time of authentication i.e. IKE_AUTH this is the ONLY field available to
the IKE responder to make this determination, IMHO.

There may be other ways e.g. some new field in the BU that can be used
to determine this. The problem I see is that if we cannot determine
IPsec vs. IPsec+MIP6 at the time of IKE_AUTH, we will have to send two
AAA messages i.e. one for IKE_AUTH (use MIP6 app ID: for authentication
only) and second when the BU is received (use MIP6 app ID for
authorization only).

The downside of this is obvious, double AAA transaction each for
authentication and authorization even when both use same MIP6 app ID.

-Kuntal

> From: [email-masked]
> [mailto:[email-masked]]
> Sent: Wednesday, March 21, 2007 4:41 AM
> To: Chowdhury, Kuntal; [email-masked];
> [email-masked]; [email-masked]
> Subject: RE: [Dime] Consensus Call regarding Diameter MobileIPv6HA-to-
> AAAHsupport
> 
> Hi Kuntal,
>