Subject: Re: [mobile-ip] A proposal for resolving a very Possible conflictbetween RFC3220 & RFC3012 (RFC3012bis)

From: Charlie Perkins <[email-masked]>
Date: Tue, 19 Mar 2002 16:47:52 -0800

Hello Pete,

Pete McCann wrote:

> I believe we will need to update the MN-HA key in the first RRQ/RRP,
> sometimes.
>
> Maybe the right approach is to update the text in 3220 to explicitly
> allow zero security associations with home agents, if some other
> "authorization enabling extension" is present in the message.

If so, the time to do so would be this week, so that we can get it in at
the same time we supply the mysteriously vanished text, and update the
"exactly one", and relieve the possibility for misinterpretation that was
noticed during Connectathon.

Regards,
Charlie P.

---

From: Pete McCann <[email-masked]>
Date: Wed, 20 Mar 2002 10:37:29 -0600 (CST)

Hi, Charlie,

Ok, understanding the urgency, how about the following text:

Change the first paragraph of Section 3.5.2 to read:

  At least one authorization-enabling extension MUST be present in all
  Registration Requests, and also in all Registration Replies generated
  by the Home Agent.  This requirement is intended to eliminate problems
  [2] which result from the uncontrolled propagation of remote redirects
  in the Internet.  The location of the extension marks the end of the
  authenticated data covered by that extension.

  The Mobile-Home Authentication Extension is always an
  authorization-enabling for registration messages specified in this
  document; future specifications may define additional
  authorization-enabling extensions.

And the first sentence of Section 3.6:

   A mobile node MUST be configured with a netmask and a mobility
   security association for each of its pre-assigned home agents or
   home agents that could be discovered on a home subnet according
   to procedures in Section 3.6.1.2.

Also, I assume that the missing text people have been discussing
covers the subnet-directed broadcast discovery mechanism in 3.6.1.2; I 
can't find it there now.

Also, I think the text in 3.6.1.3 (section header currently missing)
needs to change to:

      a) The IP header, followed by the UDP header, followed by the
         fixed-length portion of the Registration Request, followed by

      b) If present, any non-authentication Extensions expected to be
         used by the home agent (which may or may not also be useful to
         the foreign agent), followed by

      c) A mobile-home authentication extension, if present, followed by

      d) If present, any non-authentication Extensions used only by the
         foreign agent, followed by

      e) An authorization-enabling extension, if present, followed by

      f) The Mobile-Foreign Authentication Extension, if present.

   Note that item (a) and at least one of (c) or (e) MUST appear in
   every Registration Request sent by the mobile node.  Items (b), (d),
   and (f) are optional.  However, item (f) MUST be included when the
   mobile node and the foreign agent share a mobility security
   association.

I think that should do it.

-Pete