Subject: [Secauth] Step1: clarification of requirements and usecase draft

From: Hosnieh Rafiee <[email-masked]>
Date: Mon, 18 Aug 2014 13:17:43 +0000

Folks,

Before I submit any document to IETF, I need your inputs on the following information. This is the summary of the requirement draft.

I thought it would be easier to consider some questions and answer them:

1- What are the existing authentication, authorization and accounting approaches (some examples):
RADIUS 
Host Identity Protocol (HIP) 
Open Standard for Authorization (OAuth) 
Diameter  

2- How do they often secure their communications (provide both privacy and security)
- IPsec
- TLS 
- SSL

3- Is there any problem with the above security approaches?
IMHO, Yes
- IPsec: it might be key management 
- TLS and SSL: either need a CA or hardcopy of the keys in any node that wants to communicate with the service provider (such as a web site which provide a service). CA might be costly and also might allow a government!? to do pervasive monitoring. Self certification would be the problem of key exchange since each node needs to have the hardcopy of the keys. Having a CA makes it also one way direction. How to avoid spoofing if it is self certification and how to do key management?
If it is hardcopy of key on the device, it never changes and might allow an attacker to track this node based on its key. Otherwise there is no key exchange between two nodes.

4- What solution can we work on here?
The use of ORCHID algorithm with one of network layer approaches; the one that prevents IP spoofing. Use of RSA is not our choice instead the use of ECC, the latest algorithm (Curve) is our choice for having higher performance.

Why? This eliminates the needs of CA and also prevents IP spoofing.

5- Requirements
Functionality
-	Operates in both IPv4 and IPv6 networks (however the focus would be IPv6 since IPv4 is sunsetting...)
-	Requires minimum human interaction (automates the process as much as possible)
-	Supports different clients with different resources (Memory, Battery, CPU, etc.) - Laptops, IPod, Smartphone, sensor nodes, cars, etc. 
Good performance for constrained devices.
-	Provides security and a user defined privacy 
-	Be able to authenticate and authorize nodes in case there are proxy servers or other intermediate nodes in the middle of the communications
-	Enable the use of this approach in visualization environment and for the authentication of different virtual nodes in clouds where Software Defined Network (SDN) or Network Function Virtualization (NFV) techniques are in use.
Implementation and Operational View
-	Platform independent. In other words, supports multiple platforms (Windows, Linux, UNIX, etc.)
-	Easily integrate with any other application layer authentication mechanisms
-	Provide supports for Software Defined Networks (SDN)
6- Some Use cases
6.1. Virtualization
- authentication and authorization of data plane to control plane in SDN
- 
6.2. Authentication of a node via different  protocols
SSH?
SIP?
SMTP?
etc.

I also want to arrange an online meeting and will prepare some slides to discuss the requirement draft further and other use cases that needs to take into consideration.

There are some possibilities:
I chose the time slot that is possible for both who are in Europe and other part of the world.
http://doodle.com/se3gyys9dnre4nyr 

Please choose your desire time. I hope that we can have this online meeting for clarifications.
I will setup a remote meeting after I know the people who will attend.

Thanks,
Best,
Hosnieh

---

From: Hosnieh Rafiee <[email-masked]>
Date: Mon, 18 Aug 2014 15:18:44 +0000

Follow up,
Here is the link to latest version. 
< http://editor.rozanak.com/show.aspx?u=AZ6AA4BFD809BB71B2544CTAM >

I am also enclosing this version in case you have problem access it over the above link.

I would love to receive your comments either editorial or technical. Please share all your thoughts.

Thanks,
Best,
Hosnieh