Subject: [Dime] Issue with draft-ietf-dime-mip6-split-01 - Application usage

From: "Avi Lior" <[email-masked]>
Date: Sun, 4 Mar 2007 16:57:56 -0500

Folks,

I have an issue or I am missing something.

In the document you say:

"it is recommended that, when EAP is used
   for authentication, the Diameter EAP application will be used only
   for Authentication purpose. "

Then this will be followed by  another Diameter interaction.

Please tell me "This ain't so". I don't agree with this at all because
this is highly inefficient and it doesn't make sense.

I would think that an MSA that was serious about efficiencies etc will
have a Diameter Application for MIPv6 that is built on top of Diameter
EAP and extended to support MIP6 attributes.

The HA will discover this existance (in the usual 35888 way) and it
would use that application.

If the MSA does not have that application then the HA will use the
Diameter EAP application and followed by this other application called
Diameter MIP6 Authz/Acc.

Finally, you would think that an MSA having to invest on a Diamter
Application for MIP will upgrade their Diameter EAP application no?

========================

Avi Lior                                    
Bridgewater Systems Corporation 
Phone :  +1 (613) 591-9104 x6417
Cell    :  +1 (613) 796-4183
E-mail : mailto:[email-masked]
<mailto:[email-masked]> 
www.bridgewatersystems.com <http://www.bridgewatersystems.com/>  

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: "Julien Bournelle" <[email-masked]>
Date: Sun, 4 Mar 2007 23:31:49 +0100

Hi Avi,

 Thanks for reading the draft.

 Basically we have a long story with
this application. To sum up, it appeared that we needed a new
application ID for that AAA knows that it is performing AAA operations
for MIP6 service, then it was thought better to separate Authentication
and Authorization to avoid update of Diameter MIP in case of
update of 4072. Then, we had lengthy debate on whether it is good or
not from a security perspective. We are now in the process of launching
a WG consensus call on moving with a Diameter MIP performing
Authentication (with EAP) and Authorization in one application. This consensus
call should be launched before next IETF meeting.

 Regards,

 Julien

---

From: "Avi Lior" <[email-masked]>
Date: Sun, 4 Mar 2007 21:05:30 -0500

I know at least some of this story.  I was dispointed though when I read
through the draft.

So I can you can guess which way I will lean.

Again a single Diameter MIP6 Application built on top of EAP to do AuthN
and AuthZ is the way to go.

After all that is what RADIUS will do.  You cant have RADIUS be better
then Diameter right?

The only sticking point -- and I know this is an issue for the draft --
is what to do about MIP Auth 4285.  If you were also to handle it then
this Application will not always do EAP.  It will mean that the
application will run on top of NASREQ as well.

-----Original Message-----
From: Julien Bournelle [mailto:[email-masked]] 
Sent: Sunday, March 04, 2007 5:32 PM
To: Avi Lior
Cc: [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: [Dime] Issue with draft-ietf-dime-mip6-split-01 -
Application usage

Hi Avi,

 Basically we have a long story with
this application. To sum up, it appeared that we needed a new
application ID for that AAA knows that it is performing AAA operations
for MIP6 service, then it was thought better to separate Authentication
and Authorization to avoid update of Diameter MIP in case of update of
4072. Then, we had lengthy debate on whether it is good or not from a
security perspective. We are now in the process of launching a WG
consensus call on moving with a Diameter MIP performing Authentication
(with EAP) and Authorization in one application. This consensus call
should be launched before next IETF meeting.

 Regards,

 Julien