Subject: [Mip6] RE: [Dime] Certificate Support for the MIPv6 BootstrappingSplitScenario

From: "Giaretta, Gerardo" <[email-masked]>
Date: Mon, 3 Sep 2007 08:19:01 -0700

Hi Hannes,

I agree with your assumption.

I think that for inter-operator roaming scenarios the main solution is
based on IKEv2, possibly with EAP support. PSK may be used in IKEv2 if
it is dynamically derived but this is not part of the current solution. 

Gerardo

> -----Original Message-----
> From: Tschofenig, Hannes (NSN - DE/Germany - MiniMD)
> [mailto:[email-masked]]
> Sent: Monday, September 03, 2007 3:56 PM
> To: Giaretta, Gerardo; Hannes Tschofenig; Mobile IPv6 Mailing List;
> [email-masked]
> Subject: AW: [Dime] Certificate Support for the MIPv6
> BootstrappingSplitScenario
> 
> Thanks for the quick response.
> 
> One final remark:
> 
> When authentication is done at the HA via certificates you essentially
> need to assume that the AAA server is in the same administrative
domain
> as the HA since otherwise you would introduce a security problem. I
> guess you are aware of this limitation compared to the variant where
the
> authentication is provided to the AAA server itself.
> 
> Ciao
> Hannes
> 
> 
> > Hi Hannes,
> >
> > The bootstrapping draft is not clear on this, because the AAA
> > interactions requirements are discussed in
> > draft-ietf-mip6-aaa-ha-goals.
> >
> > Unfortunately this draft is now expired but I'm working on a new
> > version.
> > Based on the last version there is the following goal:
> >
> >    G2.2  The HA MUST be able to query the AAAH server to verify
Mobile
> >       IPv6 service authorization for the mobile node.
> >
> > This goal is independent of the authentication method used.
> > Therefore I
> > think that the Diameter backend infrastructure should be designed in
a
> > flexible way to support the following scenarios:
> >
> > - both authentication and authorization are performed via the AAA
> > backend
> > - authentication is done locally while authorization is
> > performed by the
> > AAA server
> > - both authentication and authorization are performed locally
> >
> > Ciao
> > Gerardo
> >
> > > -----Original Message-----
> > > From: Hannes Tschofenig [mailto:[email-masked]]
> > > Sent: Saturday, September 01, 2007 11:41 AM
> > > To: Mobile IPv6 Mailing List; [email-masked]
> > > Subject: [Dime] Certificate Support for the MIPv6 Bootstrapping
> > > SplitScenario
> > >
> > > Hi all
> > >
> > > in our attempt to complete the work on the Diameter Mobile IPv6
> > > bootstrapping documents we encountered the following issue:
> > >
> > >
> > http://www.ietf.org/internet-drafts/draft-ietf-mip6-bootstrapp
> > ing-split-
> > > 07.txt
> > > talks about the possibility to perform a certificate based user
> > > authentication by the home agent. That's fine.
> > >
> > > There is, however, the question what that implies for
> > Diameter backend
> > > infrastructure usage. Did the group assume that just the
> > authentication
> > > part will be done locally but authorization and accounting
> > still with
> > > the AAA server?  Or, was everything supposed to be done
> > locally at the
> > > home agent without any Diameter interaction to the Diameter
server?
> > >
> > > Ciao
> > > Hannes
> > >
> > >
> > > _______________________________________________
> > > DiME mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/dime
> >
> > _______________________________________________
> > DiME mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/dime
> >

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6