Subject: [mobile-ip] Additional question on BAs

From: Vladislav Yasevich <[email-masked]>
Date: Mon, 19 Aug 2002 13:22:45 -0400

Hi

If the BA is sent to the mobile node, in response to BU, with
the status of 137 (Invalid authenticator), 138 (Expired Home Nonce Index),
or 139 (Expired Care-of Nonce Index), shuld this BA contains
the Authorization Data option and authenticator?

It looks to me like it should not because the CN was unable
to authenticate the BU.

-vlad
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Vladislav Yasevich	       Tru64 UNIX - IPv6 Project Lead
Hewlett Packard 	       Tel: (603) 884-1079
Nashua, NH 03062	       ZKO3-3/T07

---

From: Jari Arkko <[email-masked]>
Date: Thu, 22 Aug 2002 13:32:40 +0300

> It looks to me like it should not because the CN was unable

Right.

Section 9.4.4. has been silent about this. Suggested text:

    The packet in which the Binding Acknowledgement is returned
    MUST meet the specific authentication requirements for Binding
    Acknowledgements, defined in Section 5.2.  Furthermore, if the packet
    ...

=>

    If the Status field in the Binding Acknowledgement contains the value
    137, 138, or 139, then the message MUST NOT include
    the Binding Authorization Data mobility option. Otherwise,
    the Binding Authorization Data mobility option MUST be included, and
    MUST meet the specific authentication requirements for Binding
    Acknowledgements as defined in Section 5.2.6.

    If the packet ...

Jari

---

From: Vladislav Yasevich <[email-masked]>
Date: Thu, 22 Aug 2002 14:00:09 -0400

Jari

Slight problem the text you supplied.  BAD option in
the BAck should only be included if the BU containted
a BAD option.

So I would change the text slightly:

    If the Status field in the Binding Acknowledgement contains the value
    137, 138, or 139, then the message MUST NOT include
    the Binding Authorization Data mobility option. Otherwise,
    the Binding Authorization Data mobility option MUST be included if
    the Binding Update message contained the option, and
    MUST meet the specific authentication requirements for Binding
    Acknowledgements as defined in Section 5.2.6.

    If the packet ...

-vlad

--

---

From: Jari Arkko <[email-masked]>
Date: Thu, 22 Aug 2002 21:28:18 +0300

> the BAck should only be included if the BU containted

True, but if the text was in 9.4.4 then BADs are required
in the BUs in any case. I'm also assuming 137 covers
missing BAD.

Jari

---

From: Vladislav Yasevich <[email-masked]>
Date: Thu, 22 Aug 2002 14:38:33 -0400

Jari

If we assume that the CN will ALWAYS do RR, then your
new text in section 9.4.4 would be enough.

I was thinking of a possibility where there is some
other mechanism which does not depend on RR and
thus would not have sent the authenticator in the BU.

So, it might good to actually state that the BAD option
is include only if RR method was used and the message
was successufly authenticated.

-vlad

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 22 Aug 2002 11:46:27 -0700

Hello Vlad,

I do not agree that use of the Binding Authentication
Data option should be restricted in that way.  For one
thing, it should be usable whenever the nodes involved
have enough information to carry out the computation,
whether by manual configuration or some other proprietary
means or some other future standard protocol.

Regards,
Charlie P.

---

From: Vladislav Yasevich <[email-masked]>
Date: Thu, 22 Aug 2002 15:31:31 -0400

Hello Charly

I guess it depends on the specification of the
"other" protocols.  The text I sent was simply
my interpretation.  I  did not realize that the
original consideration was to re-use Binding
Authorization Data in other authentication schemes.

Upon re-reading the Section 6.2.7, I withdraw
my objection to the clarified text.

-vlad

---

From: "James Kempf" <[email-masked]>
Date: Thu, 22 Aug 2002 13:08:29 -0700

Agree.

            jak