Subject: RE: [eap] RE: [Isms] RADIUS is not a trusted third party

From: "Martin Soukup" <[email-masked]>
Date: Tue, 19 Apr 2005 20:43:04 -0400

I definitely look at RADIUS as a trusted third party:

Parties involved:

- authenticating entity (user/application)
- authenticator/policy enforcement point (device)
- authoritative authentication source/policy decision point (RADIUS)

Martin.

> -----Original Message-----
> From: Alper Yegin [mailto:[email-masked]] 
> Sent: April 19, 2005 8:29 PM
> To: [email-masked]; 'Tschofenig Hannes'; 'Sam Hartman'; 
> Soukup, Martin [CAR:5K50:EXCH]
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: RE: [eap] RE: [Isms] RADIUS is not a trusted third party
> 
> 
> Glen,
> 
> > > what is radius for you? (you write that it is not a trusted third
> > > party.)
> > 
> > It's not.  From the point of view of authentication protocols (PAP, 
> > CHAP, EAP, etc.), both RADIUS and Diameter are just "wires":
> 
> What happens when we look at this picture from the 
> "authorization" perspective? "Host-to-NAS authorization for 
> the network access service" is dynamically generated from 
> "host-to-AAA server" authorization and "AAA server to client 
> (NAS)" authorization. Wouldn't this constitute a 3-party model?
> 
> Alper
> 
> 
> > the
> > operation of the auth protocols should be exactly the same 
> as if they 
> > terminated in the AAA client, instead of elsewhere.  Basically, the 
> > purpose of AAA (again, from the POV of an authentication
> > protocol) is simply scaling.  BTW, a lot of misery has been 
> caused by 
> > the erroneous belief that EAP is (or can be) a three-party 
> > authentication protocol: it isn't, and can't be.  It could 
> _carry_ a 
> > three-party protocol (like Kerberos), but EAP in itself is 
> a two-party 
> > protocol.
> > 
> > > why do you care that only one party knows that radius is used? it 
> > > could also be diameter.
> > >
> > > i would like to better understand why some people dislike the aaa 
> > > architecture (radius, diameter).
> > 
> > I think that the misunderstanding mentioned above might 
> have something 
> > to do with it...
> > 
> > >
> > > ciao
> > > hannes
> > >
> > >
> > >> -----Ursprüngliche Nachricht-----
> > >> Von: [email-masked] 
> > >> [mailto:[email-masked]] Im Auftrag von Sam Hartman
> > >> Gesendet: Freitag, 15. April 2005 19:34
> > >> An: Martin Soukup
> > >> Cc: [email-masked]
> > >> Betreff: [Isms] RADIUS is not a trusted third party
> > >>
> > >>
> > >>>>>>> "Martin" == Martin Soukup <[email-masked]> writes:
> > >>
> > >>     Martin> RADIUS "Access-Accept" indicates a successful
> > >>     Martin> authenthentication response for a user.
> > >>
> > >>     Martin> The Access-Accept already returns a
> > "Session-Timeout",
> > >>     Martin> defined as "Sets the maximum number of seconds of
> > service
> > >>     Martin> to be provided to the user before the session
> > >>     Martin> terminates. This attribute value becomes the per-user
> > >>     Martin> "absolute timeout."".
> > >>
> > >> This only tells the SNMP engine talking to the RADIUS server the 
> > >> timeout.  You need to tell the other side of the exchange the 
> > >> timeout too.
> > >>
> > >> Remember that RADIUS is a callout service; it is not a trusted
> > third
> > >> party.  In other words, in a particular SNMP authentication, only
> > one
> > >> of the parties will know that RADIUS is being used.
> > >>
> > >>
> > >> _______________________________________________
> > >> Isms mailing list
> > >> [email-masked] https://www1.ietf.org/mailman/listinfo/isms
> > >>
> > >
> > > _______________________________________________
> > > Isms mailing list
> > > [email-masked] https://www1.ietf.org/mailman/listinfo/isms
> > 
> > Hope this helps,
> > 
> > ~gwz
> > 
> > Why is it that most of the world's problems can't be solved 
> by simply
> >   listening to John Coltrane? -- Henry Gabriel
> > _______________________________________________
> > eap mailing list
> > [email-masked]
> > http://mail.frascone.com/mailman/listinfo/eap
> 
> 
> 
> 
_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Tue, 19 Apr 2005 18:05:08 -0700

Parties involved: 

In order for a "trusted third party" in the technical sense to
exist, the other two parties need to a) know about its existence and
b) trust it.  Does the "authenticating entity" know about the RADIUS
server?  

Martin.

---

From: Jeff Mandin <[email-masked]>
Date: Wed, 20 Apr 2005 14:24:15 +0200

On 4/20/05, Glen Zorn (gwz) <[email-masked]> wrote:
> 
> I
> In order for a "trusted third party" in the technical sense to exist, the 
> other two parties need to a) know about its existence and b) trust it. Does 
> the "authenticating entity" know about the RADIUS server?

In an EAP scenario the peer does in fact know about the AAA Server (or 
rather it always assumes that the AAA might be there). Consequently the 
AAA-Server does resemble a TTP in the EAP case - as Jesse Walker wrote at 
length in http://mail.frascone.com/pipermail/eap/2004-October/002895.html

There are scenarios (eg. mobile wireless) where the peer is _not at all_ 
interested in the identity of the NAS - but only that the NAS is trusted by 
the larger entity (ie. operator) that uses the AAA-Server for access 
enforcement. That would amount to an inversion of what seems to be the 
standard trust model for RADIUS etc.

- Jeff Mandin

> [email-masked] <[email-masked]>; 'Tschofenig Hannes'; 'Sam Hartman'; 
> > > >> [mailto:[email-masked] <[email-masked]>] 
> Im Auftrag von Sam Hartman