Subject: RE: [Mip4] Issue #45; Seeking closure for on deregistration withFHAE

From: "Kent Leung \(kleung\)" <[email-masked]>
Date: Thu, 30 Jun 2005 00:15:19 -0700

Hi Pete.  Looks good.  Some minor comments and few questions below. 

> -----Original Message-----
> From: Pete McCann [mailto:[email-masked]] 
> Sent: Wednesday, June 29, 2005 11:22 AM
> To: [email-masked]
> Cc: Henrik Levkowetz; Charles E.Perkins; Kent Leung (kleung)
> Subject: Re: [Mip4] Issue #45; Seeking closure for on 
> deregistration withFHAE
> 
> 
> Proposed resolution of Issue #45:
> 
> Section 3.5.4:
> 
> Remove the sentence:
>    The Foreign-Home Authentication extension MUST NOT be applied to
>    deregistration messages.
> 
> Replace the following:
>    In order to perform the authentication, the Home Agent and the
>    Foreign Agent have to have configured a security association that
>    is able to be indexed by use of the SPI and the care-of address
>    assocated with the Foreign Agent.  This care-of address 
> MUST be used
>    as the Source IP address of the Registration Request containing the
>    Foreign-Home Authentication Extension.  
> with:
>    In order to perform the authentication, the Home Agent and the
>    Foreign Agent have to have configured a security association that
>    is able to be indexed by use of the SPI and the Source IP of the
>    Registration Request containing the Foreign-Home Authentication
>    Extension.
> 

KL> 

Not sure if this text is any clearer or not?  I'm OK either way.

   In order to perform the authentication, the Home Agent and the
   Foreign Agent are configured with a mobility security association
that
   is indexed by the SPI (in the appended Foreign-Home Authentication 
   Extension) and the IP Source Address of the Registration Request.

> 
> Section 3.8.1:
> Replace the following:
>    When receiving a Registration Request
>    from a foreign agent, if the home agent shares a mobility security
>    association with the foreign agent, the home agent MUST check the
>    Authenticator in the required Foreign-Home Authentication Extension
>    in the message, based on this mobility security association.
> with:
>    When receiving a Registration Request from a foreign agent, if the
>    home agent shares a mobility security association with the foreign
>    agent, the home agent MUST check the Authenticator in the required
>    Foreign-Home Authentication Extension in the message, based on this
>    mobility security association, unless the Lifetime field equals 0.
>    When processing a Registration Request with Lifetime=0, the HA MAY
>    skip checking for the presence and validity of a Foreign-Home
>    Authentication Extension.
> 

KL> If HA skips checking the presence of FHAE, then validity check is
already bypassed.

Change:

   When processing a Registration Request with Lifetime=0, the HA MAY
   skip checking for the presence and validity of a Foreign-Home
   Authentication Extension.

To:

   When processing a Registration Request with Lifetime=0, the Home
Agent MAY
   skip the Foreign-Home Authentication Extension.

KL>

What happens to extensions between MHAE and MFAE when MFAE is skipped?
Are they also skipped since these extensions are no longer protected?
Or they are processed normally, which is implicitly implied in current
text.

KL>

Do we also need to change "MUST" to "MAY" for checking the FHAE in the
RRP with Lifetime=0 in the section below?  Else FA will send RRP with
error code 68 to MN.  I can't find what was agreed upon for FA
processing of the RRP w/o FHAE from HA.

3.7.1:

   As with any node on the Internet, a foreign agent MAY also share
   mobility security associations with any other nodes.  When relaying a
   Registration Request from a mobile node to its home agent, if the
   foreign agent shares a mobility security association with the home
   agent, it MUST add a Foreign-Home Authentication Extension to the
   Request and MUST check the required Foreign-Home Authentication
   Extension in the Registration Reply from the home agent (Sections 3.3
   and 3.4). 

KL>

Inconsistency encountered:

http://people.nokia.net/~charliep/txt/mobileip/rfc3344bis.txt

Error code 68 is missing in section 3.4, but referenced in 3.7.3.1.

Kent

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 30 Jun 2005 10:49:28 +0200

Inline...

> Hi Pete.  Looks good.  Some minor comments and few questions below. 
[...]

>>   assocated with the Foreign Agent.  This care-of address MUST be used
>    Foreign Agent are configured with a mobility security association that

Looks good to me

>    When processing a Registration Request with Lifetime=0, the Home Agent MAY

I prefer the original version - what you argue is correct, but I find the
original text is more explicit, and matching how I'd think when implementing
this...

> Or they are processed normally, which is implicitly implied in current

The latter, I think.  Do you have a position on this, Kent?

>    Extension in the Registration Reply from the home agent (Sections 3.3

Yes, this change should be done to match the other one above.

> Error code 68 is missing in section 3.4, but referenced in 3.7.3.1.

Oops!  Gremlins at work.  Charlie, you need to speak sternly to your
pets ;-)  It's there in RFC 3344 but has been inexplicably lost here...

	Henrik