Subject: Re: [AAA-WG]: Section 8.1

From: Joe Lau <[email-masked]>
Date: Wed, 3 Oct 2001 11:53:52 -0700 (PDT)

> We have defined MIP-FA-to-HA-SPI  MIP-FA-to-MN-SPI  two AVPs, why don't we 
> put these AVPs in the MIP-FA-to-HA-Key  MIP-FA-to-MN-Key to replace the
> MIP-Peer-SPI ?    In other words, see below
>       MIP-FA-to-MN-Key ::= < AVP Header: 326 >
>                            { MIP-FA-to-MN-SPI }
>                            { MIP-Algorithm-Type }
>                            { MIP-Session-Key }
>                          * [ AVP ]
> 
>       MIP-FA-to-HA-Key ::= < AVP Header: 328 >
>                            { MIP-FA-to-HA-SPI }
>                            { MIP-Algorithm-Type }
>                            { MIP-Session-Key }
>                          * [ AVP ]
> By the way, I don't think we can impletement stateless diameter server by
> requesting for example "If the MIP-FA-to-HA-Key is in the HAR it must be
> returned in the HAA so it can be inserted into the AMA." and so on.
> Because in redirect case, there is no guarantee that whay avps you send, you
> will see all of them from the redirect answer. So all the diameter have to 
> keep the state. please correct me if I am wrong.

I agree with Michael that _all_ diameter have to keep state.
Another good example would be the following statement on section 1.2.

   During the creation of the HAR, the AAAH MUST use a different session
   identifier than the one used in the AMR/AMA (see figure 2). Of
   course, the AAAH MUST use the _same_ session identifier for _all_ HARs
   initiated on behalf of a given mobile node's session. 

This will require the AAAH server to be stateful.  

Anyone disagree on this?

Joe

> Joe Lau wrote:
> 
> > > The general idea was that the HA modify the SPI value in the
> > > MIP-FA-to-HA-Key, and return the updated AVP in the HAA.
> >
> > But there is no more MIP-FA-to-HA-Key in HAA on the draft version 8, alpha.
> > Did you mean MIP-FA-to-HA-SPI instead?  Or, did I miss somthing in this
> > discussion?
> >
> > Joe
> 
> --------------E9A36EF30F9B970D0F625B9D
> Content-Type: text/html; charset=us-ascii
> Content-Transfer-Encoding: 7bit
> 
> <!doctype html public "-//w3c//dtd html 4.0 transitional//en">
> <html>
> <tt>We have defined MIP-FA-to-HA-SPI&nbsp; MIP-FA-to-MN-SPI&nbsp; two AVPs,
> why don't we put these AVPs in the MIP-FA-to-HA-Key&nbsp; MIP-FA-to-MN-Key
> to replace the MIP-Peer-SPI ?&nbsp;&nbsp;&nbsp; In other words, see below</tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MIP-FA-to-MN-Key ::= &lt; AVP Header:
> 326 ></tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> { MIP-FA-to-MN-SPI }</tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> { MIP-Algorithm-Type }</tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> { MIP-Session-Key }</tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> * [ AVP ]</tt><tt></tt>
> <p><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MIP-FA-to-HA-Key ::= &lt; AVP Header:
> 328 ></tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> { MIP-FA-to-HA-SPI }</tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> { MIP-Algorithm-Type }</tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> { MIP-Session-Key }</tt>
> <br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
> * [ AVP ]</tt>
> <br><tt>By the way, I don't think we can impletement stateless diameter
> server by requesting for example "If the MIP-FA-to-HA-Key is in the HAR
> it must be returned in the HAA so it can be inserted into the AMA." and
> so on.</tt>
> <br><tt>Because in redirect case, there is no guarantee that whay avps
> you send, you will see all of them from the redirect answer. So all the
> diameter have to keep the state. please correct me if I am wrong.</tt><tt></tt>
> <p><tt>-Michael</tt>
> <br><tt></tt>&nbsp;<tt></tt>
> <p>&nbsp;
> <p>Joe Lau wrote:
> <blockquote TYPE=CITE>> The general idea was that the HA modify the SPI
> value in the
> <br>> MIP-FA-to-HA-Key, and return the updated AVP in the HAA.
> <p>But there is no more MIP-FA-to-HA-Key in HAA on the draft version 8,
> alpha.
> <br>Did you mean MIP-FA-to-HA-SPI instead?&nbsp; Or, did I miss somthing
> in this
> <br>discussion?
> <p>Joe</blockquote>
> </html>
> 
> --------------E9A36EF30F9B970D0F625B9D--
> 
>

---

From: "Fredrik Johansson" <[email-masked]>
Date: Thu, 4 Oct 2001 18:18:32 +0200

I agree that the AAAh must be statefull anyway so there is no
gain in sending the FA keys to the HA

so, the key distribution avps will now look like this?
(adding the key lifetime avp as well)

                     { MIP-Key-Lifetime }
                     * [ AVP ]

                     { MIP-Key-Lifetime }
                     * [ AVP ]

MIP-HA-to-FA-Key ::= < AVP Header: 329 >
                     { MIP-Algorithm-Type }
                     { MIP-Session-Key }
                     { MIP-Key-Lifetime }
                     * [ AVP ]

MIP-HA-to-MN-Key ::= < AVP Header: 332 >
                     { MIP-Algorithm-Type }
                     { MIP-Replay-Mode }
                     { MIP-Session-Key }
                     { MIP-Key-Lifetime }
                     * [ AVP ]

MIP-MN-to-FA-Key ::= < AVP Header: 325 >
                     { MIP-Algorithm-Type }
                     { MIP-Key-Material }
                     { MIP-Key-Lifetime }
			   { AAA-SPI } <--- spi pointing to mn-aaa sec context
                     * [ AVP ]

MIP-MN-to-HA-Key ::= < AVP Header: 331 >
                     { MIP-Algorithm-Type }
                     { MIP-Replay-Mode }
                     { MIP-Key-Material }
                     { MIP-Key-Lifetime }
                     { AAA-SPI } <--- spi pointing to mn-aaa sec context
                     * [ AVP ]

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf Of
>Joe Lau
>Sent: den 3 oktober 2001 20:54
>To: [email-masked]
>Cc: [email-masked]; [email-masked];
>[email-masked]; [email-masked]; [email-masked]
>Subject: Re: [AAA-WG]: Section 8.1
>
>
><br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
>;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
><br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
>;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
><br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
>;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>> { MIP-Session-Key }</tt>
>>
><br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
>;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>&nbsp;&nbsp;&nbsp;
>> * [ AVP ]</tt><tt></tt>
><br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
>;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
><br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
>;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
><br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
>;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>> { MIP-Session-Key }</tt>
>>
><br><tt>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp
>;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
>&nbsp;&nbsp;&nbsp;
>> * [ AVP ]</tt>

---

From: Michael Chen <[email-masked]>
Date: Thu, 04 Oct 2001 10:08:29 -0700

In aaa-key-08 draft, there is only MN-FA Key Material contain lifetime field so
it's not necessary to put key-lifetime in all the key avps. Well, if we do, all
the key-lifetime values are same, aren't they? So we only need send this avp to FA
and HA. I would suggest add this MIP-Key-Lifetime AVP in HAR and AMA message
instead of inlcude it in the group key AVPs.

-Michael

---

From: Mark Eklund <[email-masked]>
Date: Thu, 4 Oct 2001 14:09:53 -0400

> it's not necessary to put key-lifetime in all the key avps. Well, if we do, all

That tricked me also.  But I think you have to consider two drafts when
deciding what is required.

draft-ietf-mobileip-gen-key-01.txt:

5. Generalized MN-HA Key Reply Extension
       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |     Type      |    Subtype    |            Length             |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                            Lifetime                           |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                   MN-HA Key Reply Subtype Data ...
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

draft-ietf-mobileip-aaa-key-08.txt:

6. Unsolicited MN-HA Key Material From AAA Subtype

   The Unsolicited MN-HA Key Material From AAA is subtype 1 of the
   Generalized MN-HA Key Reply Extension [12].
       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                            AAA SPI                            |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                             HA SPI                            |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |     Algorithm Identifier      |         Replay Method         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Key Material ...
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Thus the lifetime is required because the Unsolicited MN-HA Key
Material in encapsulated in the Generalized MN-HA Key Reply Extension
which does require a lifetime.

The same goes for the Generalized FA-HA Key Reply Extension.

-mark

 > <tt>In aaa-key-08 draft, there is only MN-FA Key Material contain lifetime
 > field so it's not necessary to put key-lifetime in all the key avps. Well,
 > if we do, all the key-lifetime values are same, aren't they? So we only
 > need send this avp to FA and HA. I would suggest add this MIP-Key-Lifetime
 > AVP in HAR and AMA message instead of inlcude it in the group key AVPs.</tt><tt></tt>
 > <p><tt>-Michael</tt>
 > <br><tt></tt>&nbsp;
 > <br>&nbsp;
 > <p>Fredrik Johansson wrote:
 > <blockquote TYPE=CITE>I agree that the AAAh must be statefull anyway so
 > there is no
 > <br>gain in sending the FA keys to the HA
 > <p>so, the key distribution avps will now look like this?
 > <br>(adding the key lifetime avp as well)
 > <p>MIP-FA-to-MN-Key ::= &lt; AVP Header: 326 >
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-FA-to-MN-SPI }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Algorithm-Type }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Session-Key }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Key-Lifetime }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > * [ AVP ]
 > <p>MIP-FA-to-HA-Key ::= &lt; AVP Header: 328 >
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-FA-to-HA-SPI }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Algorithm-Type }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Session-Key }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Key-Lifetime }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > * [ AVP ]
 > <p>MIP-HA-to-FA-Key ::= &lt; AVP Header: 329 >
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Algorithm-Type }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Session-Key }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Key-Lifetime }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > * [ AVP ]
 > <p>MIP-HA-to-MN-Key ::= &lt; AVP Header: 332 >
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Algorithm-Type }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Replay-Mode }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Session-Key }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Key-Lifetime }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > * [ AVP ]
 > <p>MIP-MN-to-FA-Key ::= &lt; AVP Header: 325 >
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Algorithm-Type }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Key-Material }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Key-Lifetime }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { AAA-SPI } &lt;--- spi pointing to mn-aaa sec context
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > * [ AVP ]
 > <p>MIP-MN-to-HA-Key ::= &lt; AVP Header: 331 >
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Algorithm-Type }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Replay-Mode }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Key-Material }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Key-Lifetime }
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { AAA-SPI } &lt;--- spi pointing to mn-aaa sec context
 > <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > * [ AVP ]
 > <p>>-----Original Message-----
 > <br>>From: [email-masked] [<a href="mailto:[email-masked]">mailto:[email-masked]</a>]On
 > Behalf Of
 > <br>>Joe Lau
 > <br>>Sent: den 3 oktober 2001 20:54
 > <br>>To: [email-masked]
 > <br>>Cc: [email-masked]; [email-masked];
 > <br>>[email-masked]; [email-masked]; [email-masked]
 > <br>>Subject: Re: [AAA-WG]: Section 8.1
 > <br>>
 > <br>>
 > <br>>> We have defined MIP-FA-to-HA-SPI&nbsp; MIP-FA-to-MN-SPI&nbsp; two
 > AVPs,
 > <br>>why don't we
 > <br>>> put these AVPs in the MIP-FA-to-HA-Key&nbsp; MIP-FA-to-MN-Key to
 > replace the
 > <br>>> MIP-Peer-SPI ?&nbsp;&nbsp;&nbsp; In other words, see below
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MIP-FA-to-MN-Key ::= &lt; AVP
 > Header: 326 >
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-FA-to-MN-SPI }
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Algorithm-Type }
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Session-Key }
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > * [ AVP ]
 > <br>>>
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MIP-FA-to-HA-Key ::= &lt; AVP
 > Header: 328 >
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-FA-to-HA-SPI }
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Algorithm-Type }
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > { MIP-Session-Key }
 > <br>>>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
 > * [ AVP ]
 > <br>>> By the way, I don't think we can impletement stateless diameter
 > server by
 > <br>>> requesting for example "If the MIP-FA-to-HA-Key is in the HAR it
 > must be
 > <br>>> returned in the HAA so it can be inserted into the AMA." and so
 > on.
 > <br>>> Because in redirect case, there is no guarantee that whay avps
 > <br>>you send, you
 > <br>>> will see all of them from the redirect answer. So all the
 > <br>>diameter have to
 > <br>>> keep the state. please correct me if I am wrong.
 > <br>>
 > <br>>I agree with Michael that _all_ diameter have to keep state.
 > <br>>Another good example would be the following statement on section 1.2.
 > <br>>
 > <br>>&nbsp;&nbsp; During the creation of the HAR, the AAAH MUST use a different
 > session
 > <br>>&nbsp;&nbsp; identifier than the one used in the AMR/AMA (see figure
 > 2). Of
 > <br>>&nbsp;&nbsp; course, the AAAH MUST use the _same_ session identifier
 > for _all_ HARs
 > <br>>&nbsp;&nbsp; initiated on behalf of a given mobile node's session.
 > <br>>
 > <br>>This will require the AAAH server to be stateful.
 > <br>>
 > <br>>Anyone disagree on this?
 > <br>>
 > <br>>Joe
 > <br>>
 > <br>>
 > <br>>> Joe Lau wrote:
 > <br>>>
 > <br>>> > > The general idea was that the HA modify the SPI value in the
 > <br>>> > > MIP-FA-to-HA-Key, and return the updated AVP in the HAA.
 > <br>>> >
 > <br>>> > But there is no more MIP-FA-to-HA-Key in HAA on the draft
 > <br>>version 8, alpha.
 > <br>>> > Did you mean MIP-FA-to-HA-SPI instead?&nbsp; Or, did I miss somthing
 > in this
 > <br>>> > discussion?
 > <br>>> >
 > <br>>> > Joe
 > <br>>>
 > <br>>> --------------E9A36EF30F9B970D0F625B9D
 > <br>>> Content-Type: text/html; charset=us-ascii
 > <br>>> Content-Transfer-Encoding: 7bit
 > <br>>>
 > <br>>> &lt;!doctype html public "-//w3c//dtd html 4.0 transitional//en">
 > <br>>> &lt;html>
 > <br>>> &lt;tt>We have defined MIP-FA-to-HA-SPI&amp;nbsp;
 > <br>>MIP-FA-to-MN-SPI&amp;nbsp; two AVPs,
 > <br>>> why don't we put these AVPs in the MIP-FA-to-HA-Key&amp;nbsp;
 > <br>>MIP-FA-to-MN-Key
 > <br>>> to replace the MIP-Peer-SPI ?&amp;nbsp;&amp;nbsp;&amp;nbsp; In other
 > words,
 > <br>>see below&lt;/tt>
 > <br>>> &lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > MIP-FA-to-MN-Key ::= &amp;lt;
 > <br>>AVP Header:
 > <br>>> 326 >&lt;/tt>
 > <br>>>
 > <br>>&lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp
 > <br>>;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>> { MIP-FA-to-MN-SPI }&lt;/tt>
 > <br>>>
 > <br>>&lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp
 > <br>>;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>> { MIP-Algorithm-Type }&lt;/tt>
 > <br>>>
 > <br>>&lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp
 > <br>>;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>> { MIP-Session-Key }&lt;/tt>
 > <br>>>
 > <br>>&lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp
 > <br>>;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>> * [ AVP ]&lt;/tt>&lt;tt>&lt;/tt>
 > <br>>> &lt;p>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > MIP-FA-to-HA-Key ::= &amp;lt;
 > <br>>AVP Header:
 > <br>>> 328 >&lt;/tt>
 > <br>>>
 > <br>>&lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp
 > <br>>;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>> { MIP-FA-to-HA-SPI }&lt;/tt>
 > <br>>>
 > <br>>&lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp
 > <br>>;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>> { MIP-Algorithm-Type }&lt;/tt>
 > <br>>>
 > <br>>&lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp
 > <br>>;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>> { MIP-Session-Key }&lt;/tt>
 > <br>>>
 > <br>>&lt;br>&lt;tt>&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp
 > <br>>;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>&amp;nbsp;&amp;nbsp;&amp;nbsp;
 > <br>>> * [ AVP ]&lt;/tt>
 > <br>>> &lt;br>&lt;tt>By the way, I don't think we can impletement stateless
 > diameter
 > <br>>> server by requesting for example "If the MIP-FA-to-HA-Key is in
 > the HAR
 > <br>>> it must be returned in the HAA so it can be inserted into the AMA."
 > and
 > <br>>> so on.&lt;/tt>
 > <br>>> &lt;br>&lt;tt>Because in redirect case, there is no guarantee that
 > whay avps
 > <br>>> you send, you will see all of them from the redirect answer. So
 > all the
 > <br>>> diameter have to keep the state. please correct me if I am
 > <br>>wrong.&lt;/tt>&lt;tt>&lt;/tt>
 > <br>>> &lt;p>&lt;tt>-Michael&lt;/tt>
 > <br>>> &lt;br>&lt;tt>&lt;/tt>&amp;nbsp;&lt;tt>&lt;/tt>
 > <br>>> &lt;p>&amp;nbsp;
 > <br>>> &lt;p>Joe Lau wrote:
 > <br>>> &lt;blockquote TYPE=CITE>> The general idea was that the HA modify
 > the SPI
 > <br>>> value in the
 > <br>>> &lt;br>> MIP-FA-to-HA-Key, and return the updated AVP in the HAA.
 > <br>>> &lt;p>But there is no more MIP-FA-to-HA-Key in HAA on the draft
 > version 8,
 > <br>>> alpha.
 > <br>>> &lt;br>Did you mean MIP-FA-to-HA-SPI instead?&amp;nbsp; Or, did
 > I miss somthing
 > <br>>> in this
 > <br>>> &lt;br>discussion?
 > <br>>> &lt;p>Joe&lt;/blockquote>
 > <br>>> &lt;/html>
 > <br>>>
 > <br>>> --------------E9A36EF30F9B970D0F625B9D--
 > <br>>>
 > <br>>></blockquote>
 > </html>

---

From: "Fredrik Johansson" <[email-masked]>
Date: Fri, 5 Oct 2001 09:50:45 +0200

You're right, it would be better to just have one MIP-Key-Lifetime AVP in
the HAR and AMA to prevent the lifetimes from being different on the
different keys.
The only trick with that is to mandate it's presens when there is a
MIP-...-Key AVP present in the HAR or AMA.

Pat, has there been a decision on having a Key Lifetime AVP instead of the
authorization lifetime?

/Fredrik
  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]On Behalf Of
Michael Chen
  Sent: den 4 oktober 2001 19:08
  To: Fredrik Johansson
  Cc: Joe Lau; [email-masked]; [email-masked];
[email-masked]
  Subject: Re: [AAA-WG]: Section 8.1

  In aaa-key-08 draft, there is only MN-FA Key Material contain lifetime
field so it's not necessary to put key-lifetime in all the key avps. Well,
if we do, all the key-lifetime values are same, aren't they? So we only need
send this avp to FA and HA. I would suggest add this MIP-Key-Lifetime AVP in
HAR and AMA message instead of inlcude it in the group key AVPs.
  -Michael

  Fredrik Johansson wrote:

    MIP-MN-to-FA-Key ::= < AVP Header: 325 >
                         { MIP-Algorithm-Type }
                         { MIP-Key-Material }
                         { MIP-Key-Lifetime }
                               { AAA-SPI } <--- spi pointing to mn-aaa sec
context
                         * [ AVP ]

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 7 Oct 2001 14:57:30 -0700

> This will require the AAAH server to be stateful.  

I do. Keeping transaction state is sufficient to handle this.

PatC