Subject: RE: [mobile-ip] Authenticating BU and PKI

From: "Powell, Ken" <[email-masked]>
Date: Thu, 3 May 2001 13:15:49 -0400

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Thursday, May 03, 2001 12:19 PM
> To: [email-masked]
> Subject: Re: [mobile-ip] Authenticating BU and PKI
> 
>    The CN can form the HA's address by forming a 
>    Home Agents Anycast address as described in -13.
>    As for how do you know that the HA is sending
>    the information -- just as well as the CN knows
>    that the MN is sending the information. Meaning,
>    to the degree you trust the integrity of the
>    routing system, you can trust replies from the
>    MN's home agent about as much as replies from
>    the MN itself.

This may not work if there are multiple home agents
on the home network. I expect a home agent will be
able to support authentication of the mobile node
only if it has a current home registration binding
for that mobile node. Any message sent to the home
agent's anycast address could go to any of the home
agents on the network, not necessarily the one
with the mobile node's home registration.

---

From: Michael Thomas <[email-masked]>
Date: Thu, 3 May 2001 10:29:27 -0700 (PDT)

> with the mobile node's home registration.

   I would think that that would affect home agent
   discovery in general. That said, Steve Deering mentioned
   to me a while ago that he didn't see how the
   home agent anycast couldn't be formed without
   the knowledge of the subnet mask to form the
   prefix correctly. So is the implication that 
   the mobile node not only needs to know its home
   address, but the subnet prefix as well when
   it's doing home agent discovery?

   This all sounds rather, well, not very
   automatic to me, and would have problems with
   renumbering, etc, etc.

	      Mike