Subject: RE: [Mip6] comments on chakrabarti-mip6-bmip

From: "Soliman, Hesham" <[email-masked]>
Date: Thu, 9 Dec 2004 15:22:01 -0500

> > So, while AAA can be leveraged for authentication and authorisation
 > > for many services, this doesn't mean it has to.
 > 
 > I said that in the context of bootstrapping -- discovering a 
 > HA via DNS,
 > and getting Mobile IPv6 service from it. Can we always assume that MN
 > has a pre-established SA with all such possible HAs? 

=> Sometimes yes and sometimes no. 

   If not, we still
 > need to get HA in touch with some server that knows MN. That's what I
 > was referring to as "AAA for Mobile IPv6 service". 
 > 
 > Do you have some alternative thoughts?

=> No, I wanted to highlight that different services can have
their own authentication without relying on AAA. I'm not 
ruling out AAA in anyway, but at the same time I don't
want to rule out non-AAA solutions by implicitly assuming that
service authentication is always based on AAA. 

Hesham

 > 
 > Alper
 >  
 > 
 > 
 > 
 > > 
 > > Hesham
 > > 
 > >  >
 > >  > It is not likely that an HA learned via DNS would already have
 > >  > authentication/authorization information for the MN. 
 > Hence, even a
 > >  > DNS-learned HA is likely to rely on a MIP6-AAA application to
 > >  > authenticate the MN. Please see draft-yegin-mip6-aaa-fwk-00.txt.
 > And
 > >  > (imho) real value of IKEv2 is that it allows use of EAP,
 > >  > which fits into
 > >  > MN-HA-AAA model described in mip6-aaa-fwk I-D. Not a 
 > standard, but
 > >  > products already assign IP addresses via IKEv1.
 > >  >
 > >  > Alper
 > >  >
 > >  >
 > >  >
 > >  > _______________________________________________
 > >  > Mip6 mailing list
 > >  > [email-masked]
 > >  > https://www1.ietf.org/mailman/listinfo/mip6
 > >  >
 > > 
 > > ===========================================================
 > > This email may contain confidential and privileged material for the
 > sole
 > > use
 > >  of the intended recipient.  Any review or distribution by 
 > others is
 > > strictly
 > >  prohibited.  If you are not the intended recipient please 
 > contact the
 > > sender
 > >  and delete all copies.
 > > ===========================================================
 > > 
 > 
 > 
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alper Yegin <[email-masked]>
Date: Thu, 09 Dec 2004 16:01:32 -0800

> => Sometimes yes and sometimes no.

That's a "no" ;-) 

> service authentication is always based on AAA.

OK, I agree. We need a RADIUS/Diameter-based solution, but that does not
mean everyone must use that only.

Alper