Subject: [mobile-ip] [AAA-WG]: HA-FA key in Mobile IP (fwd)

From: Sivasundar Ramamurthy <[email-masked]>
Date: Thu, 7 Feb 2002 10:24:03 -0800 (PST)

Hello,

I had sent the attached email to the AAA WG but am yet to receive a
response. Can someone in this group provide any info in this regard?
Given all the energy in this list (the R bit issue) and the
involvement of many Mobile IP implementors, my hopes are positive...:-)

Thanks in advance!

Siva

ps: for those in the AAA WG list, sorry for the cross post....

---------- Forwarded message ----------
Date: Fri, 1 Feb 2002 16:40:00 -0800 (PST)
From: Sivasundar Ramamurthy <[email-masked]>
To: AAA Working Group <[email-masked]>
Subject: [AAA-WG]: HA-FA key in Mobile IP

Hello,

Section 4.5 in the Diameter Mobile IP Application draft states:

If the FA's local policy allows it to receive AAA session keys, and it
it does have any exisiting keys with the HA, it may set the FA-HA-Key
request flag (in the feature vector).

The word "any" seems to imply that for every HA that it talks to,
the FA can maintain a single key and use it whenever it
communicates with that HA (irrespective of the MN involved).

And to be in sync with the FA, the HA should also maintain a single
HA-FA key for each FA and use it whenever it communicates with the FA
(irrespective of the MN involved)

At the same time, the phrase "AAA Session Key" seems to imply that the
HA-FA key is session specific. That is, the FA will maintain a
seperate HA-FA key for each session (MN), irrespective of whether the
FA has a key to the same HA that was obtained via some other MN.  
Thus the HA-FA key used to create or verify the authenticator will
depend on the MN in question.

And to be in sync with the FA, the HA will need to maintain session
specific HA-FA keys, irrespective of whether the HA has a key to the
same FA that was obtained via some other MN. Thus the HA-FA key used
to create or verify the authenticator will depend on the MN in
question.

Are both interpretations correct? If so, then it does seem possible
that the implementor of the HA follows one of them and the FA
implementor the other. This will lead to unnecessary authentication
failures between the HA and FA, which can be prevented by making one
interpretation the standard.

But if only of the above interpretations is correct, I am guessing it
is the first one. But can we make it more explicit?

thanks!

Siva