Subject: [Ecrit] Unauthenticated ES Work from EMU

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Mon, 17 Nov 2008 18:02:13 +0200

I just attended the EMU meeting and noticed that there is a document in
the group that addresses issues raised by the IEEE about unauthenticated
emergency services (submitted via a liaison statement). 

Here is the document and the respective section:
http://tools.ietf.org/html/draft-ietf-emu-eaptunnel-req-01#section-3.5

3.5.  Emergency Services Authentication

   When wireless VOIP service is provided, some regulations require any
   user to be able to gain access to the network to make an emergency
   telephone call.  To avoid eavesdropping on this call, it's best to
   negotiate link layer security as with any other authentication.

   Therefore, the tunnel method SHOULD allow anonymous peers or server-
   only authentication, but still derive keys that can be used for link
   layer security.  The tunnel method MAY also allow for the bypass of
   server authentication processing on the client.  Forgoing
   authentication increases the chance of man-in-the-middle and other
   types of attacks that can compromise the derived keys used for link
   layer security.

This also reminds me to check with Wimax and IEEE about this topic in
relationship to the draft 
http://tools.ietf.org/id/draft-schulzrinne-ecrit-unauthenticated-access-
04.txt
This document got recently updated and now contains new terminology.
Your feedback would be valuable. 

Ciao
Hannes
_______________________________________________
Ecrit mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ecrit