Subject: RE: [mobile-ip] Collocated COA operation and RADIUS based user auth

From: [email-masked]
Date: Wed, 23 Oct 2002 17:48:35 -0500

> 
> Hello,
> 
> I have a question:
> 
> A MIP user may be authenticated, conforming to common Remote 
> Access current practice, 
> using CHAP by including MN-HAAA based on challenge issued by a FA.
> The same user may need at some point to use collocated care 
> of address mode,
> perhaps because it is in an environment where the FA is not 
> available. This makes
> the use of CHAP problematic since it is not posssible to 
> challenge the MN.
> 
> If so, should the HA be extended to send a challenge in a special 
> reg-response message, so that subsequently the HA may authenticate
> the user in a follow-up RRQ?? On the other hand, the option 
> of letting the MN use a locally generated challenge, albeit 
> simpler, may prove not to be extremely safe? 

If there is no FA which implies that there is no Agent advertisement
that carries the challenge (as per RFC3012), how does the MN authenticate
via the Radius infra? PPP or link layer procedures can be used to 
authenticate the MN to the Radius infra. Why is the locally generated
challenge any less secure than the FA generated challenge? 

From your description above I believe Radius is used to authenticate the
MN. So are you implying that the MN would include the MN-AAA auth extension
that is sent to the HA and the HA would forward this to the Radius server?

-Basavaraj

> 
> any feedback really welcome.
> 
> alessio
> 
>