Subject: RE: [Dime] Consensus Call regarding Diameter Mobile IPv6 HA-to-AAAHsupport

From: "MORAND Lionel RD-CORE-ISS" <[email-masked]>
Date: Wed, 14 Mar 2007 23:55:39 +0100

I'm fine with that proposal.
I would add that the authentication procedures defined for the Diameter MIPv6 application must be flexible enough to support various authentication modes/schemes.

BR,

Lionel

> -----Message d'origine-----
> De : Hannes Tschofenig [mailto:[email-masked]] 
> Envoyé : mercredi 14 mars 2007 22:22
> À : [email-masked]
> Objet : [Dime] Consensus Call regarding Diameter Mobile IPv6 
> HA-to-AAAHsupport
> 
> Hi all,
> 
> with our work on the "Diameter Mobile IPv6  HA-to-AAAH 
> support" document (see
> http://www.ietf.org/internet-drafts/draft-ietf-dime-mip6-split-01.txt)
> we defined a new Diameter application and we then decided 
> that we should separate the authentication and authorization 
> interaction to avoid an update of this specification when RFC 
> 4072 is updated. This means that the Diameter MIPv6 app-ID is 
> used for the authorization part and the Diameter EAP app-ID 
> is used for the authentication part. Diameter routing may 
> cause authentication and authorization messages to be routed 
> to different servers. This caused a lengthy debate on 
> security issues. 
> It seems that there is a lot of complexity associated with 
> this approach.
> 
> I would therefore like to hear whether working group members 
> are OK with performing authentication and authorization as 
> part of one Diameter application. This would therefore mean 
> that we are going to use the Diameter MIPv6 app-ID for 
> authentication and for authorization.
> 
> Please state your opinion.
> 
> Ciao
> Hannes
> 
> 
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dime
> 
> 

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 15 Mar 2007 21:49:57 +0100

Hi Lionel,

> I'm fine with that proposal.
Thanks for the feedback.

> I would add that the authentication procedures defined for the Diameter MIPv6 application must be flexible enough to support various authentication modes/schemes.
Based on the discussions in the MIP6 working group we have to support 
the EAP-based bootstrapping via IKEv2 and also RFC 4285.

Ciao
Hannes