Subject: RE: [Mip6] comments on chakrabarti-mip6-bmip

From: Samita Chakrabarti <[email-masked]>
Date: Tue, 11 Jan 2005 16:01:21 -0800 (PST)

Catching up with the mails after a long break...

Please see below.

> 
>    If not, we still
>  > need to get HA in touch with some server that knows MN. That's what I
>  > was referring to as "AAA for Mobile IPv6 service". 
>  > 
>  > Do you have some alternative thoughts?
> 
> => No, I wanted to highlight that different services can have
> their own authentication without relying on AAA. I'm not 
> ruling out AAA in anyway, but at the same time I don't
> want to rule out non-AAA solutions by implicitly assuming that
> service authentication is always based on AAA. 

Agree with Hesham's comment here. This is the message this draft
is trying to convey. Section 2 of the draft provides example cases
when AAA may not be necessary at all. LDAP can be used as store
and different interfaces (such as identity server, Liberty protocols)
could be used for mip6-bootstrapping. While AAA is definitely a major
part in deployment of large scale global MIP6 services, AAA does not
have to be the only mechanism for boot-strapping. Thus AAA and non-AAA
soultions are both useful and necessary.

Perhaps this point will have to be clarified in the next revision.

Thanks,
-Samita

>  > 
>  > 
>  > 
>  > > 
>  > > Hesham
>  > > 
>  > >  >
>  > >  > It is not likely that an HA learned via DNS would already have
>  > >  > authentication/authorization information for the MN. 
>  > Hence, even a
>  > >  > DNS-learned HA is likely to rely on a MIP6-AAA application to
>  > >  > authenticate the MN. Please see draft-yegin-mip6-aaa-fwk-00.txt.
>  > And
>  > >  > (imho) real value of IKEv2 is that it allows use of EAP,
>  > >  > which fits into
>  > >  > MN-HA-AAA model described in mip6-aaa-fwk I-D. Not a 
>  > standard, but
>  > >  > products already assign IP addresses via IKEv1.
>  > >  >
>  > >  > Alper
>  > >  >
>  > >  >
>  > >  >
>  > >  > _______________________________________________
>  > >  > Mip6 mailing list
>  > >  > [email-masked]
>  > >  > https://www1.ietf.org/mailman/listinfo/mip6
>  > >  >
>  > > 
>  > > ===========================================================
>  > > This email may contain confidential and privileged material for the
>  > sole
>  > > use
>  > >  of the intended recipient.  Any review or distribution by 
>  > others is
>  > > strictly
>  > >  prohibited.  If you are not the intended recipient please 
>  > contact the
>  > > sender
>  > >  and delete all copies.
>  > > ===========================================================
>  > > 
>  > 
>  > 
>  > 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Samita Chakrabarti <[email-masked]>
Date: Thu, 13 Jan 2005 10:35:06 -0800 (PST)

Hi Junghoon,
> 
> I have one question about your bmip draft.
> In your draft, HA discovery is performed by looking up the DNS server.
> Do you have any idea about securing that process ?
> 

This is a good point. Yes, we are planning to have a secure DNS lookup
process for HA address  in the next revision of the draft.
The authors have been discussing that now.

Thanks,
-Samita

> The draft-ietf-mip6-bootstrap-ps draft says about the securing 
> the bootstrapping configuration information.
> 
> [Page 7]
> 3. Design Goals
>   o  Configuration information which is exchanged between the mobile
>       node and the home agent must be secured using integrity and replay
>       protection.  Confidentiality protection SHOULD be provided if
>       necessary.
> 
> I think that the configuration information includes the HA address.
> 
> Regards,
> 
> Junghoon
> 
> 
> ----- Original Message ----- 
> From: "Samita Chakrabarti" <[email-masked]>
> To: <[email-masked]>; <[email-masked]>
> Sent: Wednesday, January 12, 2005 9:10 AM
> Subject: Re: [Mip6] comments on chakrabarti-mip6-bmip
> 
> 
> > 
> > 
> > 
> > > > I think that we could have 2 solutions for bootstrapping Mobile IPv6:
> > > >
> > > >  - one based on AAA infrastructure
> > > >
> > > >  - one that could be used without AAA
> > > 
> > 
> > That's the idea of bmip draft. Although one could use non-AAA
> > mechanism for boot-strapping for business reason and then HA
> > may independently work with AAA server for accounting purpose.
> > 
> > -Samita
> > 
> >

---

From: [email-masked]
Date: Fri, 21 Jan 2005 09:22:34 +0200

Hi James,

> if the word "business model" seems inappropriate, then do:
> 
> s/business model/deployment model"
> 
> on line 1 of the message.
> 
> enterprises whose business may have nothing to do with it may also choose a
> particular deployment model that would require a different kind of
> bootstrapping.

That is an improvement, actually.  I can live with it.

John