Subject: RE: [Mip6] Mip6 and AAA?

From: "Narayanan Vidya-CVN065" <[email-masked]>
Date: Wed, 19 Oct 2005 17:33:10 -0400

There isn't a scenario in draft-ietf-mip6-aaa-ha-goals that addresses
the case where the auth protocol is used in place of IPSec SA between
the MN and HA - scenarios 3 & 4 in the draft refer to the case where the
HA is contacting the AAA server for mip6 service authorization, not
necessarily authentication of the MN itself. Of course, this can be
easily extended, but I am not sure if the AAA attributes will be the
same - I would expect different AVPs to be defined for this purpose. 

Maybe it makes sense to have a scenario 5 there that talks about this
case - the MN sends a BU with the MN-AAA Auth option and the HA sends
the BU to the AAAH for authentication and authorization? 

Also, draft-tschofenig-mip6-aaa-ha-diameter-00 doesn't really have text
in it about BU exchange between the HA and AAA - not sure if that
matters. 

Vidya 

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]] 
> Sent: Wednesday, October 19, 2005 3:40 PM
> To: Narayanan Vidya-CVN065
> Cc: [email-masked]
> Subject: Re: [Mip6] Mip6 and AAA?
> 
> Narayanan Vidya-CVN065 wrote:
> > All,
> > In order to use the MN-AAA authentication mobility option 
> defined in 
> > the Auth protocol, are there plans to define a Diameter mip6 
> > application or RADIUS mip6 attributes? Alternatively, in 
> Diameter, I 
> > would think new AVPs may be defined for the NASREQ application.
> >  
> > I'm just trying to understand if any work is done/planned 
> in this space.
> 
> as part of the mip6 bootstrapping work, we have identified 
> the need to define some AAA messages between the NAS and the 
> AAAH and between the HA and the AAAH.
> 
> draft-ietf-mip6-aaa-ha-goals-00.txt is supposed to capture 
> the AAA requirments. the plan is to talk about both RADIUS 
> and Diameter requirements in the same document. this draft 
> needs to be updated.
> 
> Vijay
> 
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Soliman, Hesham" <[email-masked]>
Date: Wed, 19 Oct 2005 17:47:48 -0400

> in it about BU exchange between the HA and AAA - not sure if that

=> Why do you need to exchange a BU between the AAA and HA? 
I followed your argument up to that point. I thought you were
talking about getting credentials from AAA to authenticate the 
BU that comes from the MN. 

Hesham

 > > and Diameter requirements in the same document. this draft 

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

---

From: "Narayanan Vidya-CVN065" <[email-masked]>
Date: Wed, 19 Oct 2005 17:54:05 -0400

> talking about getting credentials from AAA to authenticate 
> the BU that comes from the MN. 
> 

Thats fine too. In the mip4 world, the RRQ gets sent to the AAA (I think
:)). But, yes, what you say would be just fine. 

Vidya

> > > Sent: Wednesday, October 19, 2005 3:40 PM  > > To: 
> Narayanan Vidya-CVN065  > > Cc: [email-masked]  > > Subject: 
> Re: [Mip6] Mip6 and AAA?
>  > >
>  > > > In order to use the MN-AAA authentication mobility 
> option  > > defined in  > > > the Auth protocol, are there 
> plans to define a Diameter mip6  > > > application or RADIUS 
> mip6 attributes? Alternatively, in  > > Diameter, I  > > > 
>  > > > I'm just trying to understand if any work is 
> done/planned  > > in this space.
>  > >
>  > > as part of the mip6 bootstrapping work, we have 
> identified  > > the need to define some AAA messages between 
> the NAS and the  > > AAAH and between the HA and the AAAH.
>  > >
>  > > draft-ietf-mip6-aaa-ha-goals-00.txt is supposed to 
> capture  > > the AAA requirments. the plan is to talk about 
> both RADIUS  > > and Diameter requirements in the same 
> document. this draft  > > needs to be updated.
>  > >
>  > > Vijay
>  > >
>  > >
>  >
> This email may contain confidential and privileged material 
> for the sole use  of the intended recipient.  Any review or 
> distribution by others is strictly  prohibited.  If you are 
> not the intended recipient please contact the sender  and 
> delete all copies.

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Wed, 19 Oct 2005 23:55:55 +0200

hi vidya, 

the draft-ietf-mip6-aaa-ha-goals is not up-to-date with the most recent work in the mip6 bootstrapping solution design team. 

additionally, i have to mention that the work has mostly focused on ikev2. recently vijay has submitted a draft that talks about ikev1. 
i have suggested to consider also the mipv6-auth protocol some time back. 

i agree that the parameters needed for an ikev2 preshared secret and the parameters needed for the mipv6 auth-protocol are different.
still, i think that this does not justify the need for a new application.  

ciao
hannes

> -----Ursprüngliche Nachricht-----
> Von: [email-masked] [mailto:[email-masked]] Im 
> Auftrag von Narayanan Vidya-CVN065
> Gesendet: Mittwoch, 19. Oktober 2005 23:33
> An: Vijay Devarapalli
> Cc: [email-masked]
> Betreff: RE: [Mip6] Mip6 and AAA?
> 
>

---

From: "Soliman, Hesham" <[email-masked]>
Date: Wed, 19 Oct 2005 17:57:54 -0400

> :)). 

=> Ah, in the MIPv4 world things are ...emm..different :) 

Hesham

But, yes, what you say would be just fine.

---

From: "Narayanan Vidya-CVN065" <[email-masked]>
Date: Wed, 19 Oct 2005 17:58:41 -0400

Actually, on second thoughts, there may be a problem. If the MN uses
MN-AAA authentication option, the auth data in it is created with the
MN-AAA key - it might not be right to provide the HA with that
credential for it to authenticate the BU. 

OTOH, if the MN uses the MN-HA auth option (where only the MN and AAA
can derive the MN-HA shared key), the AAA can simply send the
credentials to the HA upon request. 

So, maybe there are two different cases to consider here. 

Vidya

> From: Narayanan Vidya-CVN065 
> Sent: Wednesday, October 19, 2005 4:54 PM
> To: 'Soliman, Hesham'; Vijay Devarapalli
> Cc: [email-masked]
> Subject: RE: [Mip6] Mip6 and AAA?
> 
> > 
> > I followed your argument up to that point. I thought you 
> were talking 
> > about getting credentials from AAA to authenticate the BU 
> that comes 
> > from the MN.
> > 
> 
> Thats fine too. In the mip4 world, the RRQ gets sent to the 
> AAA (I think :)). But, yes, what you say would be just fine. 
> 
> Vidya
> 
> 
> > Hesham
> > 
> > 
> >  >
> >  > Vidya
> >  >

---

From: "Narayanan Vidya-CVN065" <[email-masked]>
Date: Wed, 19 Oct 2005 17:59:43 -0400

> still, i think that this does not justify the need for a new 

Agreed. Seems to me like the NASREQ application will work fine. 

Vidya

> > Von: [email-masked] [mailto:[email-masked]] 
> Im Auftrag 
> > von Narayanan Vidya-CVN065
> > the MN and HA - scenarios 3 & 4 in the draft refer to the 
> case where 
> > the HA is contacting the AAA server for mip6 service authorization, 
> > not necessarily authentication of the MN itself. Of course, 
> this can 
> > be easily extended, but I am not sure if the AAA attributes will be 
> > the same - I would expect different AVPs to be defined for this 
> > purpose.
> > 
> > Also, draft-tschofenig-mip6-aaa-ha-diameter-00 doesn't really have 
> > text in it about BU exchange between the HA and AAA - not 
> sure if that 
> > matters.
> > 
> > Vidya
> > 
> identified the need 
> > > to define some AAA messages between the NAS and the AAAH 
> and between 
> > > the HA and the AAAH.
> > > 
> capture the AAA 
> > > requirments. the plan is to talk about both RADIUS and Diameter 
> > > requirements in the same document. this draft needs to be updated.
> > > 
> > > Vijay
> > > 
> > > 
> >

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Thu, 20 Oct 2005 00:05:41 +0200

hi hesham, 

>  > in it about BU exchange between the HA and AAA - not sure if that
the text should read 
".. have text in it about the AAA exchange between the HA and the AAA
server triggered by the BU ..."

> BU that comes from the MN. 
your observation is correct. we are talking about the AAA interaction. 

ciao
hannes

> for the sole use

---

From: Gerardo Giaretta <[email-masked]>
Date: Thu, 20 Oct 2005 00:15:37 +0200

Hi Vidya,

as mentioned by Vijay, draft-ietf-mip6-aaa-ha-goals needs to be updated. We will not be able to get a 01 version before Vancouver deadline but I hope to have a review by the DT just after the meeting. The draft was written when the bootstrapping solutions were not specified yet and thus some scenarios/considerations may need a complete rephrasing. In the Design Team, we have identified that some AAA work (e.g. AVPs) is needed for bootstrapping solutions we have defined so far. The draft will be updated accordingly.

Concerning mip6-auth stuff, as you know, this is actually out of the scope of the bootstrapping DT work. There has been some discussion in the DT but so far we have decided to focus on IPsec SA setup. I wonder if there is interest to work on a bootstrapping solution for mip6-auth and related AAA interaction. Notice that mip6-auth is currenlty informational.

--Gerardo

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Narayanan Vidya-CVN065
> Sent: mercoledì 19 ottobre 2005 23.33
> To: Vijay Devarapalli
> Cc: [email-masked]
> case where the

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

---

From: Gerardo Giaretta <[email-masked]>
Date: Thu, 20 Oct 2005 00:20:47 +0200

> Agreed. Seems to me like the NASREQ application will work fine. 

Are you referring to the AAA-HA interface in mip6-auth case or in IKEv2 case (e.g. draft-ietf-mip6-bootstrapping-split)?
 
--Gerardo

---

From: "Narayanan Vidya-CVN065" <[email-masked]>
Date: Wed, 19 Oct 2005 18:20:50 -0400

Hi Gerardo,
 
> Concerning mip6-auth stuff, as you know, this is actually out 
> of the scope of the bootstrapping DT work. There has been 
> some discussion in the DT but so far we have decided to focus 
> on IPsec SA setup. I wonder if there is interest to work on a 
> bootstrapping solution for mip6-auth and related AAA 
> interaction. Notice that mip6-auth is currenlty informational.
> 

This was my point. If this is out of scope of the DT draft, maybe it needs to be addressed separately. But, it seems like the definition of such AVPs is important for the deployment of the auth protocol. 

Vidya

> > From: [email-masked] [mailto:[email-masked]] 
> On Behalf 
> > Of Narayanan Vidya-CVN065
> This message and its attachments are addressed solely to the 
> persons above and may contain confidential information. If 
> you have received the message in error, be informed that any 
> use of the content hereof is prohibited. Please return it 
> immediately to the sender and delete the message. Should you 
> have any questions, please send an e_mail to

---

From: "Narayanan Vidya-CVN065" <[email-masked]>
Date: Wed, 19 Oct 2005 18:24:49 -0400

> Are you referring to the AAA-HA interface in mip6-auth case 
> or in IKEv2 case (e.g. draft-ietf-mip6-bootstrapping-split)?
>  

It seems to definitely apply to the mip6-auth case. I have to think more about the IKEv2 case - on the surface, it seems like that should work there too. 

Vidya

---

From: Gerardo Giaretta <[email-masked]>
Date: Thu, 20 Oct 2005 00:27:56 +0200

> It seems to definitely apply to the mip6-auth case. I have to 
> think more about the IKEv2 case - on the surface, it seems 
> like that should work there too. 
>

Diameter EAP Application may be also needed in AAA-HA interface for IKEv2 case. In fact, EAP may be used in IKE_AUTH exchange. Obviously this does not apply to mip6-auth case.

--Gerardo

---

From: "Narayanan Vidya-CVN065" <[email-masked]>
Date: Wed, 19 Oct 2005 18:32:06 -0400

> > 
> 
> Any hint from 3GPP2 plan about this? mip6-auth most important 
> deployment scenario is 3GPP2, AFAIK.
>

Yes, this is my understanding too. If some 3gpp2 folks can shed some light on this, it would be good. 

> As a side note, notice that some requirements listed in 
> AAA-HA goals draft may apply to both IPsec SA and mip6-auth scenarios.
> 

Actually, this is why I thought the extra scenarios can simply be added to that draft. A separate effort here will end up re-visiting some of the requirements already present for the IKEv2 case. 

Vidya

> > > Gruppo Telecom Italia - Direzione e coordinamento di 
> Telecom Italia 
> > > S.p.A.
> > > 
> > >