Subject: RE: [mobile-ip] Regional Registration Last Call issue #3 DISAGREE

From: "Ahmad Muhanna"<[email-masked]>
Date: Fri, 17 May 2002 09:42:37 -0500

Hello Annika;
Please see my comment below.

Hi Ahmad

At 03:38 PM 5/15/2002 -0500, Ahmad Muhanna wrote:

Hello Annika, 

Clarification: Missing technical issue 1: 

In section 4.1 the third paragraph it talks about Mobile Nodes 
with co-located care-of address and the way it uses 
Regional Registration. This section is under Home Registration. 
This means that it does not talk about the Regional Registration mechanism 
YET. Because that has a separate section No. 5. 

Now in the third paragraph section 4.1 as shown below, it talks about the 
Mobile Node adding a Hierarchical Foreign Agent extension and to be placed 
after the MN-HA authentication extension in Registration Request message. 
Also, to be protected by the MN-GFA authentication extension. It also
continues 
to say using the mobility security association which has been established
with 
GFA according to section 3.1.2. 

" ........... 
   In this case, the mobile node MUST add a 
   Hierarchical Foreign Agent extension 8.2, including its co-located 
   care-of address, to the Registration Request before sending it.  The 
   Hierarchical Foreign Agent extension SHOULD be placed after the MN-HA 
   authentication extension.  It SHOULD be authenticated by using the 
   MN-GFA authentication extension (see Section 10).  The authentication 
   data SHOULD be calculated using a mobility security association 
   that has been established with the GFA (Section 3.1.2). ........... 
" 

I am really confused here for the following points: 
1. We are talking about Home registration. Which I understand is the initial

registration with the Mobile Node Home Agent or when it changes GFA.
However, 
the text talk about the initial registration request here. 
2. Now at this point of time, there is no established mobility security
association 
between the mobile Node and GFA. 
3. section 3.1.2, talks about using the mobility security association, which
has been 
established during the initial (Home Registration), in Regional Registration
NOT Home 
Registration. 
4. In other words, Mobile Node does not have a mobility security association
with the 
GFA at the time of initial or Home registration that paragraph 3 talks
about. 

Am I correct ? or I am missing something. 

You are right. We have obviously not put enough effort on the co-located
case ;-) This should be clarified, so that in the home registrion, it's the
MN-HA auth. extension, and in the regional registration, it's the MN-GFA.

<<Ahmad>>
I DISAGREE

As per your draft text and the understanding of the functionality you are 
proposing, the Replay Protection extension is destined to the GFA NOT the 
Home Agent. It also needed in the Home Registration ONLY.
Therefore, it has to come after the MN-HA authentication extension
not before. The issue still not addressed.

<<END>>

Clarification: Technical issue 2: 
In section 8.3 paragraph 3: 
" 
   The mobile node SHOULD append the Replay Protection Style Extension 
   to the home registration following the MN-HA authentication 
   extension, but before any MN-GFA authentication extension.  Then, 
   the GFA can remove the extension without damaging the MN-HA 
   authentication data needed by the home agent. 
" 

Do we assume here that there is a statically preconfigured security
association 
between the MN and GFA which include a secret key? 

This issue is very much related with Technical issue No. 1. 

see above.
<<Ahmad>>
I DISAGREE

See comments above.

<<END>>

Clarification: Technical issue 3: 
In section 5.3. First Paragraph: 

" If the GFA accepts a request for regional registration, it MUST set 
   the lifetime to be no greater than the remaining lifetime of the 
   mobile node's registration with its home agent, and put this lifetime 
   into the corresponding Regional Registration Reply.  The GFA MUST NOT 
   accept a request for a regional registration if the lifetime of the 
   mobile node's registration with its home agent has expired.  In that 
   case the GFA sends a Regional Registration Reply with the value in 
   the Code field set to HOME_REG_EXPIRED. 
" 

Are you suggesting that the GFA keeps the binding of the Mobile Node EVEN 
after the Home registration lifetime has already expired? 

No. This should be changed so that when the GFA gets a regional reg.and it
doesn't have any home reg. for this MN, it should use a code like
"NO_HOME_REG".

Clarification: Technical issue 4: 
This is not a technical issue per say BUT it is important in my view: 

Why you are suggesting two different extensions with two different types 
for the following extensions: 

1.      GFA IP Address Extension 
2.      Hierarchical Foreign Agent Extension. 

CAN'T we use one extension as per MEIR originally and RFC3220 recently 
with one TYPE and two different subtypes. 
You never know, those type numbers are going to be very precious 
in the very near future!!! 

Yes, we should.

Thanks,
Annika

Regards; 
Ahmad Muhanna