Subject: RE: [mobile-ip] Collocated COA operation and RADIUS based user au th

From: "Casati, Alessio (Alessio)" <[email-masked]>
Date: Thu, 24 Oct 2002 10:06:39 +0100

*If there is no FA which implies that there is no Agent advertisement
*that carries the challenge (as per RFC3012), how does the MN 
*authenticate
*via the Radius infra? PPP or link layer procedures can be used to 
*authenticate the MN to the Radius infra. 

I believe that link layer auth would let the user gain
the address used for collocated COA, but then this is not sufficient for the HA
to authenticate for network access the MIP user. (The HA is many hops away
and is the only point where Home network access restrictions could be enforced).

*Why is the locally generated
*challenge any less secure than the FA generated challenge? 

Because If I'm malicious I may generate a challenge/response pair that I have
picked up by eavesdropping. Not so easy to do the same if I have to use 
a challenge generated by a third party. 

*From your description above I believe Radius is used to 
*authenticate the
*MN. So are you implying that the MN would include the MN-AAA 
*auth extension
*that is sent to the HA and the HA would forward this to the 
*Radius server?

Yes. I imagine this would be necessary if the HA wanted to use RADIUS
based auth of MIP users.

Alessio