Re: Authentication Mechanism Matrix (was L2TP vs IPSEC)

["Bernard D. Aboba" <aboba@xxxxxxxxxxxxx>]

> That part you're right about, although I've heard rumblings in the AAA group
> for distributing keys in some fashion already. I was more than surprised when
> I heard this, and asked someone: "So what are you planning on using to
> distribute these keys?" I know radius won't do it. The radius group would
> have a cow. Maybe diameter. Maybe a new protocol, I was told.

Actually, all that the AAA WG signed up for was to provide end-to-end
security for attributes, so that it would be possible for them to pass 
through untrusted proxies while remaining confidential, or avoiding 
tampering. The exact nature or determination of those attributes (which 
could be anything, including keys) is outside the scope of AAA, but 
presumably  relevant to the services that will utilize it (such as Mobile IP 
or IPSRA). Thus, key management is not within the scope of the AAA
protocol.