Subject: RE: Usage scenarios

From: <[email-masked]>
Date: Tue, 12 Feb 2002 17:09:00 -0600

> By your reference to 2977 and reducing the latency are you 
> making the argument
> that you think it is a requirement that PANA have the ability to
> "piggyback" a MIPv6 binding update as part of the 
> authentication exchange?
> 
> If you are making this case, it sure sounds like a premature 
> optimization to
> me, since there isn't any evidence that saving one roundtrip time for
> relatively infrequent movement between service providers. 

Eric, I have to admit I'm a little bit confused. You state that it is premature to try to optimize the roundtrips between the visited domain and the home domain for mobile node authentication and MIPv6 mobility. However, the AAA WG has spent quite some time already to enables such optimizations for Mobile IPv4 since such optimizations were deemed necessary. My question is then the following one: since AAA WG identified the need for such optimizations quite some time ago, and now you state that it is premature to work on this, do you have any sort of new information available that indicate that such optimizations are not needed? Such information would be definitely useful, given that the AAA WG has already identified this requirement.

Moreover, you refer to "saving one roundtrip time for relatively infrequent movement between service providers". This seems to imply that the MN may have to be authenticated only when mobility bring the MN to a different service provider. However, can we exclude a-priori that every service provider will require MN authentication only when the MN enters a new network? Can we exclude the case where a service provider organizes its own network in different domain with the policy that the MN needs to be re-authenticated when it moves from a domain to another? I don't feel very confident with such assumptions, it seems to me we're already reducing the capabilities of what we're designing.

> Also, that approach
> makes assumptions about business arrangements i.e. to what extent
> the home AAA is operated by the same organization as the home agent.
> 
> Architecturally (preserving flexibility) it makes a lot of sense to
> separate the authentication protocol from the mobility 
> management protocol.

I agree with you. I believe we are not forcing the scenario where the home AAA and home agent belong to the same provider, but simply making the assumption that security associations may be available between the home AAA and the home agent (e.g. as result of business agreement between the two organizations). However, we also considering the plausible scenario where the MN does not have any SA established a priori with the home agent whereas it may have an SA with the organization that provides the home AAA. In this type of scenario, the optimization we're re-discussing here is not a must. However, without the optimization I believe the MN not only needs (at least) a roundtrip to the home agent to get authenticated, but a given number of roundtrips between the MN and the home agent are needed to setup a SA, whereas the optimization would allow for a single roundtrip.

In conclusion, we do not believe that such optimization should be mandatory, but that the protocols should enable it for those scenarios where it is applicable, given that such optimization has already been identified as a requirement in the AAA WG.

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 13 Feb 2002 00:48:19 +0100 (CET)

Franck,

This is getting a bit off PANA topics - I'm assuming the chairs will
tell us if they don't think it belongs.

> Eric,

Touché - we're now both guilty of misspelling each others names :-)

> I have to admit I'm a little bit confused. You state that it is
> premature to try to optimize the roundtrips between the visited domain and
> the home domain for mobile node authentication and MIPv6 mobility. However,
> the AAA WG has spent quite some time already to enables such optimizations
> for Mobile IPv4 since such optimizations were deemed necessary. My question
> is then the following one: since AAA WG identified the need for such
> optimizations quite some time ago, and now you state that it is premature to
> work on this, do you have any sort of new information available that
> indicate that such optimizations are not needed? Such information would be
> definitely useful, given that the AAA WG has already identified this
> requirement.

Actually it was the mobile IP WG that produced the informational RFC which
is the requirements document and as I understand the AAA WG accepted
it without arguing.

I wish I'd caught this back when this was discussed, but it is
quite tricky since RFC 2977 isn't very explicit. It says:
   In order to reduce the number of messages that
   traverse the network for initial registration of a Mobile Node, the
   AAA functions in the visited network (AAAL) and the home network
   (AAAH) need to interface with the foreign agent and the home agent to
   handle the registration message.  Latency would be reduced as a
   result of initial registration being handled in conjunction with AAA
   and the mobile IP mobility agents.

Does it doesn't explicitly say "the registration request must be carried
through the AAA servers to the HA" or something more explicit.

It's my understanding from the AAA WG co-chairs that the above requirement
leads to quite a bit of complication in AAA servers.

> Moreover, you refer to "saving one roundtrip time for relatively infrequent
> movement between service providers". This seems to imply that the MN may
> have to be authenticated only when mobility bring the MN to a different
> service provider. However, can we exclude a-priori that every service
> provider will require MN authentication only when the MN enters a new
> network?

RFC 2977 already makes that claim it seems - it talks about initial 
registrations and subsequent registrations.

> Can we exclude the case where a service provider organizes its own
> network in different domain with the policy that the MN needs to be
> re-authenticated when it moves from a domain to another? I don't feel very
> confident with such assumptions, it seems to me we're already reducing the
> capabilities of what we're designing.

The flip-side of the coin is that the MIPv4 approach is reducing the 
capabilities since it isn't possible to apply EAP methods to authenticate
the mobile nodes.

> I agree with you. I believe we are not forcing the scenario where the home
> AAA and home agent belong to the same provider, but simply making the
> assumption that security associations may be available between the home AAA
> and the home agent (e.g. as result of business agreement between the two
> organizations).

But the claimed optimization only makes sense if the home agent and the AAAh
are close together - if the HA is indeed closer to the location of the MN
than the AAAh you are adding delay with this "optimization".
 
> However, we also considering the plausible scenario where
> the MN does not have any SA established a priori with the home agent whereas
> it may have an SA with the organization that provides the home AAA. In this
> type of scenario, the optimization we're re-discussing here is not a must.
> However, without the optimization I believe the MN not only needs (at least)
> a roundtrip to the home agent to get authenticated, but a given number of
> roundtrips between the MN and the home agent are needed to setup a SA,
> whereas the optimization would allow for a single roundtrip.

If it takes multiple roundtrips to establish a SA, wouldn't it take multiple
roundtrips to do so whether the peer is AAAh or the HA?

In any case, if I recall correctly part of the original motivation for
this followed the following logic:
 - there is no route optimization in MIPv4 which implies
 - in some cases it might be better performance-wise to allocate a local
   home agent in the visited site, which implies
 - the MN can't possible have a pre-established security relationship
   which such a dynamic HA, which implies
 - some form of dynamic establishment of security relationships is needed.

I don't recall to what extent there where other key motivations.
I observe that the lack of route optimization concern is not present in
MIPv6.
Which makes me wonder if we need any such dynamic establishment of
security relationships.

> In conclusion, we do not believe that such optimization should be mandatory,
> but that the protocols should enable it for those scenarios where it is
> applicable, given that such optimization has already been identified as a
> requirement in the AAA WG. 

Wrong WG.

There is a cost of allowing such optional behavior in terms of
complexity in the specifications. This effects not only the time it
takes to finish the specifications (the AAA WG is probably a telling example)
but also optional behavior tends to increase the risk for interoperability
problems.

Thus there is no free lunch. Which is why WGs need to be careful
not to have too many options.

  Erik