Subject: [AAA-WG]: Issue: MIP-FA-to-MN-SPI and co-located servers

From: Mark Eklund <[email-masked]>
Date: Fri, 12 Oct 2001 16:50:41 -0400

Submitter name: Mark Eklund
Submitter email address: [email-masked]
Date first submitted: 12-Oct-01
Reference: http://www.merit.edu/mail.archives/aaa-wg/2001-10/msg00101.html
Document: mobileip
Comment type: T
Priority: 1
Section: 6.0
Rationale/Explanation of issue:

  This is a sub-issue of the issue, "Issue: Required AVPs in grouped
  key AVPs" submitted earlier by me that requests changing to use the
  Key ABNA as listed in the reference above.

  The value for the MIP-FA-to-MN-SPI key is contained in the
  registration request sent by the MN (and placed in the
  MIP-Reg-Request by the FA).  The HA normally extracts this and sends
  it back to the AAAH as the MIP-FA-to-MN-SPI.  The AAAH can then
  place that in the MIP-FA-to-MN-Key and sent back to the FA.

  A problem happens with a co-located server.  When the AAAF gets an
  AMR and the MN-to-FA key was requested, it sends an AMA back to the
  FA that contains the MIP-FA-to-MN-Key and the MIP-MN-to-FA-Key.  The
  problem is that the AAAF doesn't speak mobileip and can't
  extract the MIP-FA-to-MN-SPI from the registration request.

Requested change: 
  The currently suggested ABNF for the MIP-FA-to-MN-Key and the
  MIP-MN-to-FA-Key is

    MIP-FA-to-MN-Key ::= < AVP Header: 326 >
        { MIP-FA-to-MN-SPI }
        { MIP-Algorithm-Type }
        { MIP-Session-Key }
        { MIP-Key-Lifetime }
        * [ AVP ]

    MIP-MN-to-FA-Key ::= < AVP Header: 325 >
        { MIP-Algorithm-Type }
        { MIP-Key-Material }
        { MIP-Key-Lifetime }
        { AAA-SPI }
        * [ AVP ]

  Either make the MIP-FA-to-MN-SPI in the MIP-FA-to-MN-Key optional or
  only require that the MIP-MN-to-FA-Key be sent back when the server
  is co-located and add the MIP-Session-Key as an optional AVP.  I.E.

    MIP-MN-to-FA-Key ::= < AVP Header: 325 >
        { MIP-Algorithm-Type }
        { MIP-Key-Material }
        { MIP-Key-Lifetime }
        { AAA-SPI }
        [ MIP-Session-Key ]
        * [ AVP ]

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 14 Oct 2001 07:49:54 -0700

Mark,

You've lost me here. You state that a co-located server (whatever that 
happens to be) doesn't speak mobile ip, and therefore cannot extract the
MIP-FA-to-MN-SPI AVP from the registration request. Why is the Diameter
AVP in the Mobile IP message?

I suspect that I'm misunderstanding your issue :(

PatC

---

From: Mark Eklund <[email-masked]>
Date: Mon, 15 Oct 2001 10:39:59 -0400

Let me state my (mis)understanding of this situation.  First the
non-co-located situation: 

1. A MIP-FA-to-MN-Key contains a MIP-Peer-SPI.

2. This MIP-Peer-SPI is normally sent from the HA to the AAAH in the
   form of a MIP-FA-to-MN-SPI.

3. The HA created the MIP-FA-to-MN-SPI somehow.  I'm a little fuzzy on
   this part.  Either it 
   1. extracted it from the Mobile Node SPI in the Generalized MN-FA
      Key Request extension or
   2. Generated it in some other manner.

In the co-located situation, we have three players, the mobile node
(MN), the co-located Agent that acts as both the foreign and home
agent (agent), and the aaa server that answers the requests (server).
If the MN requests a FA-to-MN key, the server will

1. Have to return both a MIP-FA-to-MN-Key and a MIP-MN-to-FA-Key.

2. Have to return something for the MIP-Peer-SPI in the MIP-FA-to-MN-Key

3. If the MIP-Peer-SPI is the same as the Mobile Node SPI in the
   Generalized MN-FA Key Request extension, it will have to speak
   Mobile-IP.

Even if 3 is not true, I would think that the agent would be
responsible for generating the MIP-Peer-SPI.

-mark

---

From: Mark Eklund <[email-masked]>
Date: Tue, 16 Oct 2001 15:12:19 -0400

Pat,

Please reject this issue, I now understand from this excerpt section
3.0 that when there is a co-located situation, the only key needed is
the MN-HA key.

   The MIP-MN-to-HA-Key and MIP-HA-to-MN-Key AVPs MUST be present if
   the session keys were requested in the AMR, and the
   Co-Located-Mobile-Node bit was set in the MIP-Feature-Vector AVP.

-mark

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 16 Oct 2001 20:04:07 -0700

> Please reject this issue...

I will gladly do so :)

PatC