Subject: [AAA-WG]: AAA SPI generation for Unsolicited MN-FA Key Material

From: Mark Eklund <[email-masked]>
Date: Tue, 2 Oct 2001 09:55:33 -0400 (EDT)

All,

I'm not certain if I have a fundamental understanding issue, or
if there is some flaw in the key distribution algorithm.  When
the HA creates an Unsolicited MN-FA Key Material in the
MIP-Reg-Reply, I can only determine how it knows 4 of the 5
fields.  The fields are taken from draft-ietf-mobileip-aaa-key-08.txt

Lifetime: MIP-Key-Lifetime AVP in MIP-MN-to-FA-Key
AAA SPI: ? (see below)
FA SPI: Mobile Node SPI in MN-FA Key Request Extension in
        MIP-Reg-Request
Algorithm Identifier: MIP-Algorithm-Type in MIP-MN-FA-Key
Key Material: MIP-Key-Material in MIP-MN-FA-Key

I think that either the AAA SPI is not available, or I don't
understand what it is.  My understanding is that it specifies the
security association between the MN and AAAH.  It is chosen by the
AAAH.  When the AAAH creates the MIP-Session-Key in the MIP-FA-MN-Key
in the AMR it uses the AAA-key that is specified by this AAA SPI.

If this is true, the HA doesn't know what the AAA-SPI is.

Elucidation would be appreciated.

Thanks,

-mark

---

From: "Fredrik Johansson" <[email-masked]>
Date: Tue, 2 Oct 2001 17:08:03 +0200

Hi Mark,

I believe you're right, there is a SPI missing in the
MIP-MN-to-FA-Key and in the MIP-MN-to-HA-Key, and that is
the SPI that the Mn will use to retreive the mn-aaa key with
which it will create the new mip key.

I suggest we either reuse the existing SPI avp (MIP-Peer-SPI, btw why peer,
strange name considering it's used for mip only and there is no peers in
mip,
can we change the name to MIP-SPI?) or add a new AVP. The former may cause
problems when explaining for what purposes the SPI is used, so I'd prefer
the latter.

Aaa-SPI AVP
The Aaa-SPI AVP (AVP Code TBD) is of type Unsigned32, and
contains the Security Parameter Index to use to reference the
key which the mobile node will use together with the key
material when creating the MIP key.

hope this clarifies things for you, I haven't had the time to go trough
the key dist. in -08-alpha, but I'll try to do that asap to see if there
are more information missing

/Fredrik