Subject: Re: issue 18: aaa interactions

From: Jari Arkko <[email-masked]>
Date: Mon, 08 Sep 2003 18:06:59 +0300

Francis Dupont wrote:

>    Now, I've been thinking about this a little bit.
>    If this is *only* about the discovery of the cert chains
> 
> => no, my idea is that there are some interactions between AAA systems
> and SEND, and the discovery of the cert chains should likely be one
> of them.

Fair enough. I agree that there might be more such interactions.
(Of course, we need to decide what to write in the current
document.)

>    via AAA, then it might be that, for instance, the 802.11
>    link layer authentication process has already learned
>    something about the network's certificates. For instance,
>    if 802.11 is running EAP TLS, and the authentication is
>    terminated directly at the AP/router, then the host already
> 
> => you don't need a "termination": local SEND and local AAA
> can share some parts of the chains, the root for instance.

Yes.

>    has the cert chain from a trusted root to the router.
>    
>    In any case, to move forward my proposal is that we simply
>    add some text explaining that as a side effect of attaching
> 
> => I'd like to see the acronym AAA somewhere.

Sufficient as an example? I may have trouble putting in
anything else than an example, given that we don't have
specific SEND-related procedures for AAA. But we can certainly
write something about certificate chain or partial chain
sharing with network access AAA. Would that work for you?

--Jari

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------