Subject: [Mip6] Questions on RFC 4285

From: "Suares Nikhil-A21070" <[email-masked]>
Date: Tue, 19 Dec 2006 20:47:53 +0800

Hi,
        I was going through RFC 4285 and had a few queries with respect
to 4285's relation to bootstrapping:
 
1) Considering the MN-HA Mobility Message Authentication Option, Section
5.1.1 says that "The Mobile Node MUST include this option in a BU if it
has a shared-key-based mobility security association with the Home
Agent."
I assume that if an MN-HA Mobility Message Authentication Option is not
present, then the Mobile Node would use the MN-AAA Message
Authentication Option.
But on going through Section 5.2, it says that although the MN-AAA
Message Authentication Option is used in authentication of the BU, the
MN-HA Message Authentication Option must be used for authentication of
the BA. This means that an MN-HA Message Authentication Option must have
been established in the time between sending the BU with MN-AAA Message
Authentication Option and the sending back of the BA. This implies that
the MN-HA Message Authentication has been setup during 4285 and
considering that the MN-HA MSA is part of bootstrapping information,
then it leads me to believe that Boostrapping seems to be an inherent
part of 4285. Is my understanding correct?
 
2) On further perusal of
"draft-devarapalli-mip6-authprotocol-bootstrap-01.txt" it seems to
indicate in Section 4 that "RFC 4285 [3] decribes how to protect Mobile
IPv6 signaling message using pre-shared keys between the mobile and the
home agent." If this is the case, then it may not hold (refer
question-1).
 
3) If the MN-HA Message Authentication Option is present, what would the
MN-AAA Message Authentication Option be used for? Would it be used only
when the MN-HA Message Authentication Option is not present?
 
Could someone please clarify these questions.
 
Thanks,
Nikhil Suares.
 
_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 28 Dec 2006 11:28:33 -0800

Hi Nikhil,

Suares Nikhil-A21070 wrote:
> has a shared-key-based mobility security association with the Home Agent."

The previous sentence says

    The assumption is that the Mobile Node has a shared-key-based
    security association with the Home Agent.

Therefore if the MN has a security association with
the HA, it must use the MN-HA authentication option.
No ambiguity there.

> present, then the Mobile Node would use the MN-AAA Message 

Or rather if the MN and the HA do not have a security
association setup already, and the MN has a security
association with the HAAA, then it includes the MN-AAA
authentication option.

> part of 4285. Is my understanding correct?

I lost you. But yes, the Binding Ack is always
protected by the MN-HA security association. The MN-HA
security association needs to be created by the time
the HA sends a binding ack, even if the binding update
was protected by the MN-AAA security association.

> home agent." If this is the case, then it may not hold (refer question-1).
>  

See the call flow in section 4 of 
draft-devarapalli-mip6-authprotocol-bootstrap-01.txt

Vijay