Subject: [AAA-WG]: FA-HA Key Generation in the foreign domain

From: Mark Eklund <[email-masked]>
Date: Tue, 2 Oct 2001 15:47:32 -0400

All,

I need to clarify what happens when the AAAF generates the FA-HA key
when the HA is in the foreign domain.  What this concerns is how the
MIP-FA-to-HA-Key gets added to the AMA.

When the AAAF gets an HAR with the FA-HA-Key-Request set in the
MIP-Feature-Vector AVP, it generates the FA-HA Key.  It then includes
it in the MIP-HA-to-FA-Key that it sends to the HA.  When it gets back
the HAA, it remembers the MIP-FA-to-HA-SPI, its own generated key, and
the Accounting-Multi-Session-Id AVP from the HA.  It then forwards the
HAA on to the AAAH.

When the AAAH sends the AMA to the AAAF, the AAAF will have to add the
MIP-FA-to-HA-Key AVP.  It will do this by matching the
Accounting-Multi-Session-Id in the AMA to the one saved when the HAA
was received.  The Accounting-Multi-Session-Id is the only thing that
is common between the HAA and the AMA.

Is this the only way the current specification will allow this?

Is there any merit to changing the specification so that if a
FA-HA-Key is generated in the foreign domain, the AAAF MUST add the
FA-to-HA-Key to the HAR and the AAAH MUST move it from the HAR to the
AMA?  This would prevent the AAAF from having to keep a lookup table
and do garbage collection on that table if the AMA is never received.
If so, I'll raise the issue.

-mark

---

From: "Bob Kopacz" <[email-masked]>
Date: Thu, 25 Oct 2001 00:48:13 -0400

Hi Mark,

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Mark Eklund
> Sent: Tuesday, October 02, 2001 3:48 PM
> To: [email-masked]
> Subject: [AAA-WG]: FA-HA Key Generation in the foreign domain
> 
> All,
> 
> MIP-Feature-Vector AVP, it generates the FA-HA Key.  

Is the MIP-Feature-Vector AVP in the HAR?  The draft-08-alpha01 is
inconsistent; the HAR ABNF shows it as optional, and the occurrence
rules table shows it as disallowed.  But it seems it better be
there, otherwise how would the AAAF know whether it should generate
FA-HA keys or not?

> It then includes
                      ^^^                                    ^^^
                      HAA                                    HAA
> and do garbage collection on that table if the AMA is never received.

I think your idea would make life easier for the AAAF.  I'm with you on
this one.

> If so, I'll raise the issue.

Bob K.

---

From: Mark Eklund <[email-masked]>
Date: Thu, 25 Oct 2001 10:41:18 -0400

Bob,

 > there, otherwise how would the AAAF know whether it should generate

My guess is that the table lags behind changes in the ABNF.  I tend to
trust the ABNF over the table.

 > > If so, I'll raise the issue.

I'll raise an issue.
-mark