Subject: Re: [AAA-WG]: Issue 195: Clarifications on key generation

From: Mark Eklund <[email-masked]>
Date: Mon, 15 Oct 2001 18:41:22 -0400

Pat,

> > This clears up a lot for me, but I have a question.
> 
> good... progress.
> 

Thanks, I still either don't quite understand or have drug up a new
issue.

> >  > 
> >  > 5.0  Key Distribution Center
> >  > 
> >  >    The mobile node and mobility agents use session keys to compute
> >  >    authentication extensions applied to registration messages, as
> >  >    defined in [4]: Mobile-Foreign, Foreign-Home and Mobile-Home.  If
> >  >    session keys are requested the AAA server(s) MUST return the key
> >  >    material after the Mobile Node is successfully authenticated and
> >  >    authorized.
> >  > 
> >  >    If the AAAH does not communicate directly with the foreign agent, and
> >  >    it does not wish for intermediate proxies to have access to the
> >  >    session keys, they SHOULD be protected using the CMS security
> >  >    application [9].
> >  > 
> >  >    The MIP-Key-Lifetime AVP contains the number of seconds before
> >  >    session keys destined for the Home Agent and/or Foreign Agent expire.
> >  >    A value of zero indicates infinity (no timeout).
> >  > 
> >  >    The SPI values are used as key identifiers, meaning that each session
> >  >    key has its own SPI value; nodes that share a key also share an SPI.
> >  >    The Mobile Node proposes SPIs for use in computing the Mobile-Foreign
> >  >    and Mobile-Home authentication extensions, via the Mobile IP AAA Key
> > 
> > Does this mean that the AAAH needs to speak mobile ip to extract this
> > SPI or will there be a new AVPs sent in the AMR for that?  Note that
> > you need to have two different AVPs since the Generalized MN-FA Key
> > Request Extension and the Generalized MN-HA Key Request Extension
> > could contain two different SPIs.
> 
> no, the AAAH MUST NOT need to know how to parse Mobile IP registration messages.

O.K. Tell me where I go wrong here.

1. The Mobile Node SPI in the Generalized MN-FA Key Request extension
   is the suggested SPI from the MN to be used by the AAAH to encrypt
   the key and send it to the HA.

2. The AAAH doesn't have to use this, but it is preferred.

3. The FA does not extract this SPI and put it in any AVP.

4. The AAAH then must extract this SPI.

5. This is a violation of the "AAAH MUST NOT need to know how to parse
   the Mobile IP registration messages".

-mark

> PatC

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 15 Oct 2001 19:25:30 -0700

>    the Mobile IP registration messages".

The only SPI AAAH needs is the MN-AAA SPI, and this can be found in the
MIP-MN-AAA-SPI AVP.

Not sure why you state that the AAAH needs the MN-FA SPI.

PatC

---

From: Mark Eklund <[email-masked]>
Date: Tue, 16 Oct 2001 13:46:31 -0400

Pat,

I think the gist of my confusion is how the AAAH chooses the AAA-SPI
for encryption and how the HA chooses the FA SPI and the HA SPI.  I
didn't find any guidance in draft-ietf-mobileip-aaa-key-08.txt or
draft-ietf-aaa-diameter-mobileip-08-alpha01.txt, but did find some in
your proposed text where you said,

    "The Mobile Node proposes SPIs for use in computing the
    Mobile-Foreign and Mobile-Home authentication extensions, via the
    Mobile IP AAA Key Request extensions [15], while the Home Agent
    allocates the Mobile- Foreign, Mobile-Home and Foreign-Home SPIs.

If following statements are correct, I am no longer confused (at not
least about this part :).

1. The AAAH MAY use the value of the MIP-MN-AAA-SPI when generating
   the MIP-Session-Key in the MIP-HA-to-MN-Key and generating the
   MIP-Session-Key in the MIP-FA-to-MN-Key, or it MAY generate one
   according to local policy.

2. As of 8-alpha01 there is no way of conveying the above AAA SPI to
   the HA.  To fix this problem, the issue was proposed in
   http://www.merit.edu/mail.archives/aaa-wg/2001-10/msg00136.html
   to add an AAA-SPI to the MIP-MN-to-FA-Key and the MIP-MN-to-HA-Key.

3. The HA MAY use the Mobile Node SPI from the MN-FA-Key Request
   extension in the MIP-Reg-Request as the FA SPI, or it MA generate
   one according to local policy.

4. The HA MAY use the Mobile Node SPI from the MN-HA-Key Request
   extension in the MIP-Reg-Request as the HA SPI, or it MAY generate
   one according to local policy.

-mark