Subject: [mobile-ip] Collocated COA operation and RADIUS based user auth

From: "Casati, Alessio (Alessio)" <[email-masked]>
Date: Wed, 23 Oct 2002 16:31:52 +0100

Hello,

I have a question:

A MIP user may be authenticated, conforming to common Remote Access current practice, 
using CHAP by including MN-HAAA based on challenge issued by a FA.
The same user may need at some point to use collocated care of address mode,
perhaps because it is in an environment where the FA is not available. This makes
the use of CHAP problematic since it is not posssible to challenge the MN.

If so, should the HA be extended to send a challenge in a special 
reg-response message, so that subsequently the HA may authenticate
the user in a follow-up RRQ?? On the other hand, the option of letting the MN use a locally generated challenge, albeit simpler, may prove not to be extremely safe? 

any feedback really welcome.

alessio

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 23 Oct 2002 12:04:34 -0700

> the user in a follow-up RRQ?? On the other hand, the option of letting the
MN use a locally generated challenge, albeit simpler, may prove not to be
extremely safe?
> any feedback really welcome.

One possible option that protocol supports is to force
the MN to send a registration request via FA even in the
co-located care-of address case. This behavior can be triggered
by setting the R bit (registration required) in the mobility agent
advertisements. This way at least the FA can verify the challenge is
valid, or even verify the authentication before passing the request
to the home agent. But of course if you don't even trust the FA, then
I don't know....

alper