Subject: [mobile-ip] RFC 3012 - what about challenges from HA

From: "Henrik Levkowetz" <[email-masked]>
Date: Sun, 9 Dec 2001 01:40:49 +0100

On going over RFC 3012 and the 3012bis draft, I'm getting puzzled by
this:

There is provisions for challenges to the MN from the FA, trough the
MIP Agent Advertisment Challenge Extension(section 2), and there is
provisions for challenges from all entities except the HA and FA
trough the Generalized Mobile IP Authentication Extension (section 5).

But this leaves the HA hanging in the middle - there's no specific
challenge extension for a HA to use, and the Generalized Mobile IP 
Authentication Extension is not defined for an HA to use.

How Come?

		Henrik

------------------------------------------------------------------------
Henrik Levkowetz +46708321608 [email-masked] www.ipunplugged.com
------------------------------------------------------------------------

---

From: Charlie Perkins <[email-masked]>
Date: Sat, 08 Dec 2001 19:42:25 -0800

Hello Henrik,

Since the home agent has a security association with the
mobile node, and since the registration request has
replay protection and authentication extension, there
isn't any need for the challenge.  The whole registration
message data can properly be considered to be a
challenge, because of the anti-replay data in the
Identificatoin field.

Regards,
Charlie P.

---

From: "Henrik Levkowetz" <[email-masked]>
Date: Sun, 9 Dec 2001 11:23:48 +0100

Hi Charlie,

	Ah, I see, then I can appreciate the reasoning. However,
what if one would like to use a pre-existing authentication
infrastructure which was designed to use challenges, instead
of creating a new set of shared secrets, public/private keys
or whatever for use with mobile ip? Might there not be a place
also for challenges from a HA in that case?

	Regards,
		Henrik