Subject: [mobile-ip] Questions about "AAA Key Distribution Draft"

From: Alpesh S Patel <[email-masked]>
Date: Thu, 07 Nov 2002 10:21:22 -0800

Charlie, Pat,

We have been going over the AAA Key Distribution draft in
detail and have the following list of questions. Can you 
please clarify them.

Thanks
Alpesh

1. The lifetime field is contained in MN-FA Key reply extension(6.4),
   and not in the MN-HA Key material from aaa subtype. 
   But, in case of MN-FA keys, the lifetime field is not
   contained in MN-FA Key reply extension, but is contained in
   MN-FA Key material from aaa subtype. What is the reason for
   this?

2. Can MN put multiple MN KeyRequestExtensions in same RRQ to
   generate multiple keys? If not, then the solution would be to send
   multiple RRQs. Can a statement in this regards put in the draft to
   clarify this behavior.

3. Section 3, point 10, the text is not very clear, especially
   at the end. I could interpret after reading it a couple of 
   times. May I suggest an alternate text:
 
   "If Registration Reply passes authentication and contains a
   MN-FA Key Material From AAA extension (see section 7.2), the
   mobile node generates th eregistration key using the Key Material
   provided, according to its security association with the AAA. The
   resulting registration key is used to establish the mobile node's
   Mobility Security Association with its foreign agent."
 
   The part after "and is used to compute ..." seems redundant.

4. A paragraph explaining the role of SPI's (how they are setup) to be
   unidirectional would help if it is spelled out clearly.

Also, the draft is supposed to rely on generic AAA 
infrastructure (RADIUS, DIAMETER etc), but looks like a
few aspects of this are very specific to DIAMETER. I am
pointing to some of them:

1. Section 1, 3rd paragraph - the text goes as: "When the Mobile IP
   Registration Reply packet is authenticated by the MN-AAA
   Authentication Extension [4] ..." 

   This seems to be Diameter specific. Typically, MN-AAA AE is
   added by MN only (in radius model). 
 
2. Section 3, 2nd paragraph - the text goes as: "Alternatively, the
   AAA server MAY provide unsolicited key material to mobile nodes;..."

   Again, this seems to be Diameter specific. 

3. Appendix D: the examples shows that RRQ never goes to HA, even
   for Mobile-Home Agent key generation. While this model holds
   well for Diameter, it seems to violate the Radius model and 
   thus does not fit well with the basic assumption of making it
   generic to fit radius/diameter.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 07 Nov 2002 10:31:35 -0800

Hello Alpesh,

With the recent focus on Mobile IPv6, this draft has gotten
laid aside for a while.  I intend to put up an issues page
for it, as was done for Mobile IPv6.  I have not spent time
with the AAA keys draft for quite a few weeks now, so it is
not fresh in my mind.

>    MN-FA Key material from aaa subtype. What is the reason for

The reason is that in the case of the foreign agent, the
lifetime of the security association might be more closely
tied with the time during which the the foreign agent is
to provide service.  This does not necessarily have any
relationship with the typical reasons why a lifetime is
assigned to a security association.

I will have to do more work before responding to the other
points below.  Most likely, they should be collected as part
of the list of issues on the coming webpage.

Regards,
Charlie P.

=========================================================================