Subject: Re: [Mip6] [MIPv6] - New I-D - Authentication mechanism in MIPv6 - draft-patel-mipv6-auth-protocol-01.txt

From: Ramin <[email-masked]>
Date: Sun, 14 Mar 2004 08:54:32 -0800

Does the draft permit or dis-allow the following:
Multiple mobile nodes with *distinct home addresses* use the *same NAI 
and the same shared key* in order to request the HA to bind their CoA to 
their HoA.

Thank you,

-Ramin

Alpesh wrote:

> Hi -
>
> A new I-D are available for comments. It describes a hash based 
> authentication for MIPv6.
>
>        Abstract                        This  document  defines  new  
> mobility  options  to  enable        authentication between mobility 
> entities. These options can be        used in addition to or in lieu 
> of IPsec to authenticate        mobility messages as defined in [1].
> Location:   
> ftp://ftp-eng.cisco.com/mipdrafts/MIPv6/draft-patel-mipv6-auth-protocol-01.txt 
>
>
> Your comments are welcome.
> Alpesh
>
>
>
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mip6
>

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Kent Leung <[email-masked]>
Date: Tue, 16 Mar 2004 22:36:19 -0800

Hi Ramin.

The draft does not disallow this scenario.  It specifies an authentication
method between an HA and the MN (identified by either NAI or HoA).

Kent

At 08:54 AM 3/14/2004 -0800, Ramin wrote:

>Multiple mobile nodes with *distinct home addresses* use the *same NAI and 
>the same shared key* in order to request the HA to bind their CoA to their HoA.
>
>Thank you,
>
>-Ramin
>
>
>Alpesh wrote:
>
>>Hi -
>>
>>entities. These options can be        used in addition to or in lieu of 
>>IPsec to authenticate        mobility messages as defined in [1].
>>Location:

---

From: Ramin <[email-masked]>
Date: Wed, 24 Mar 2004 08:37:47 -0800

> method between an HA and the MN (identified by either NAI or HoA).

The draft also does not seem to disallow MN_1 with <NAI_1, 
Shared_secret_1> to change the CoA<-->HoA binding for MN_2 with <NAI_2, 
Shared_secret_2> (assuming that both shared secrets are valid and bound 
to their NAI).

Can you please confirm?

-Ramin

>> Multiple mobile nodes with *distinct home addresses* use the *same 
>> NAI and the same shared key* in order to request the HA to bind their 
>> CoA to their HoA.
>>
>> Thank you,
>>
>> -Ramin
>>
>>
>> Alpesh wrote:
>>
>>> Hi -
>>>

---

From: Kent Leung <[email-masked]>
Date: Thu, 25 Mar 2004 10:24:11 -0800

Let me see if I understand clearly..

This is a different case where 2 MNs (MN_1 and MN_2) have 2 NAIs
(NAI_1, and NAI_2) which are associated with the same HoA.  And that
the HoA session can be moved using different NAIs (which have their own
SAs with the HA).

This draft specifies the authentication mechanism for Binding messages
between MN and HA. How the NAI to HoA mapping is accomplished is
outside the scope of the draft.  So this issue would have to be covered in
that particular draft where HoA is assigned to an NAI and how to deal
with same HoA for multiple NAIs. Typically, NAIs will have different HoAs.
 From authentication perspective, it's straightforward that there's a
security association between MN (identified by IP address or NAI) and
HA.

Hope this helps.

Kent

At 08:37 AM 3/24/2004 -0800, Ramin wrote:

>Shared_secret_2> (assuming that both shared secrets are valid and bound to 
>their NAI).
>
>Can you please confirm?
>
>-Ramin
>
>>
>>Kent
>>