Subject: [mobile-ip] [Fwd: List of Questions about "AAA Key Distribution Draft"]

From: Alpesh S Patel <[email-masked]>
Date: Mon, 05 Aug 2002 14:02:13 -0700

Hi,

We have been going over the AAA Key Distribution draft in
detail and have the following list of questions. Can someone 
clarify them.

1.  Section 3 (items 8, 9), indicates that unsoliciated key material
    can be pushed to the MN. Is the intended purpose to generate
    new keys at MN? The wording says that MN authenticates and
    then if finds 'unsolicited key material', MN generates key.
    
2. Is the intention of this draft to also facilitate HA/FA key
   distribution through AAA? If so, which entity initiates it? 
   Also, how to ensure that FA and HA reaches the same AAA server?
   (The last question is critical if AAA server is Radius).
    
3. Where is the MF KeyRequest Extension located compared to MN-AAA
    AE? If before MN-AAA AE, FA cannot remove this extension before
    forwarding RRQ to HA. Section 3 (item 4) states this, but just
    wanted to confirm.

4. Sections 6.1 and 6.3, what is included in subtype data?

5. Sections 6.2 and 6.4, what is included in subtype data? Is it 
   that this contains the extensions specified in section 8 and 9?

6. Why 6.4 has lifetime and not section 9 extension?
   Why 6.2 does not have lifetime field and section 8 extension has?
   Can you clarify this?

7. Can MN put multiple MN KeyRequestExtensions in same RRQ to
   generate multiple keys? If not, then the solution would be to send
   multiple RRQs. Can a statement in this regards put in the draft to
   clarify this behavior.

Suggestions:
------------
1. Section 5, the formulae for calculating the key is missing to take
   the AAA-key into account. It is described in the following 
   paragraph in that section. This needs to be corrected.

2. A paragraph explaining the role of SPI's (how they are setup) to be
   unidirectional would help if it is spelled out clearly.

Thanks
Alpesh

---

From: Alpesh S Patel <[email-masked]>
Date: Tue, 13 Aug 2002 10:00:14 -0700

Posting it again...