Subject: [AAA-WG]: Section 8.1

From: Mark Eklund <[email-masked]>
Date: Tue, 2 Oct 2001 12:38:50 -0400

All,

I was looking at draft-ietf-aaa-diameter-mobileip-08-alpha01.txt,
section 8.1 with respect to key distribution and needed enlightenment
on two issues.

1. Why is a MIP-MN-to-HA-Key allowed in an AMA?
   This is already encapsulated in the MIP-Reg-Reply.  Is there some
   reason the FA needs to know its value?

2. Why is a MIP-FA-to-HA-Key allowed in a HAR?
   The HA is already getting what it needs in the MIP-HA-to-FA-Key.
   In fact, the MIP-FA-to-HA-SPI is generated by the HA, so the
   MIP-Session-Key in the MIP-FA-to-HA-Key isn't even available when
   the HAR is created.

Note: I'll create issues if this brings one up.

Thanks,

-mark

---

From: "Fredrik Johansson" <[email-masked]>
Date: Wed, 3 Oct 2001 12:25:38 +0200

>   MIP-Session-Key in the MIP-FA-to-HA-Key isn't even available when

I believe that it's so the AAAh doesn't have to keep state, if the 
MIP-FA-to-HA-Key is in the HAR it must be returned in the HAA so it can 
be inserted into the AMA.

But as you point out, the SPI is not available in the AAAh before it
receives the HAA from the HA. Thus we either have to mandate the AAAh 
to keep the state, or make the SPI optional or set to a certain value
(say 0) that will changed when the new value is available.

/Fredrik

---

From: Mark Eklund <[email-masked]>
Date: Wed, 3 Oct 2001 10:16:10 -0400

> (say 0) that will changed when the new value is available.

The AAAH already has to maintain enough state to know which AMA
to send back when it gets the HAA.

According to section 8.1 the HAA can't contain a MIP-FA-to-HA-Key.

I'll make an issue to not allow a MIP-MN-to-HA-Key in an AMA, a
MIP-FA-to-HA Key in a HAR, and (a new one) not allow a MIP-FA-to-MN
Key in a HAR.

-mark

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 3 Oct 2001 09:12:13 -0700

> (say 0) that will changed when the new value is available.

The general idea was that the HA modify the SPI value in the MIP-FA-to-HA-Key,
and return the updated AVP in the HAA.

That is my understand of the agreement we had previously had in regards to the
issue on whom creates the SPI.

PatC