Subject: [Mip4] An idea about issue #45

From: "Charles E.Perkins" <[email-masked]>
Date: Fri, 22 Oct 2004 16:37:02 -0700

Hello folks,

My last e-mail included some information about issue #45
that was not quite right.   After sending that e-mail out,
I began to review more e-mails about the subject, and found
a note requesting me to change the specification so that
the registration request would be dropped by the home agent
if there is an offending Foreign-Home Authentication
extension applied to a deregistration.

Unfortunately, I am not able to complete that task in
the limited time I have available today.  However, I
found another "minimal-text" solution to the problem, and
I would like to propose it for now, include it in the
release before next Monday, and make some discussion on
the list and at the next meeting.  Please accept my
sincere regrets at (a) not tackling the task of issue #45
sooner, avoiding what has become a rush job, and (b)
not having this idea sooner so that we could have
a longer discussion before submission.  I will make
whatever changes are needed after our discussion at
the upcoming IETF, immediately after it becomes
possible to resubmit the document.

The proposed solution is very simple: namely, that the
Foreign-Home Authentication extension be modified to
prohibit inclusion in a deregistration message, as follows:

3.5.4. Foreign-Home Authentication Extension
   
   This Extension MAY be included in Registration Requests and Replies  
   in cases in which a mobility security association exists between  
   the foreign agent and the home agent, as long as the Registration
   Request is not a deregistration (i.e., it is requesting a positive
   lifetime and the home address is different than the care-of address).
   The Foreign-Home Authentication extension MUST NOT be applied to
   deregistration messages.  ...

This makes sense, because the mobile node is clearly not using
the deregistration message to ask for any service from the foreign
agent.  Furthermore, there is no danger from _malicious_ activity
from the mobile node.

Regards,
Charlie P.

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: Sri Gundavelli <[email-masked]>
Date: Fri, 22 Oct 2004 17:25:19 -0700 (PDT)

Hi Charlie,
            On the issue 45, we believe that the
solution for that problem can be based on a FA
Identity Extension and that can defined outside
the 3344bis. We can discuss this further at the
Washington IETF.

Regards !
Sri/

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 22 Oct 2004 21:18:04 -0700

Hello Sri,

The problem to be solved by having the identity extension
is not the same as the problem about what to do if the
mobile node authentication works fine, but the home agent
encounters an error within the Foreign-Home authentication
extension.  This is a relatively small sub-issue that should
have perhaps been separated out from issue #45.  It is only
this sub-issue that I was trying to solve by my proposed
restriction.

Regards,
Charlie P.