Subject: [Dime] draft-ietf-dime-mip6-split-04.txt: Proposed Next Steps

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 03 Sep 2007 22:38:43 +0200

Hi all,

I read through the mobility documents and here is a suggested approach:

Currently the document only talks about the usage of RFC 4877 (only 
EAP-based authentication) and RFC 4285. The document needs to cover 
certificate based authentication with the HA as well. In this mode only 
authorization and accounting is provided with Diameter.

The document currently references RFC 4004 with regard to the AVPs. The 
description of the AVPs in RFC 4004 often refers to the Mobile IPv4 RFC 
with regard to the semantic. We should copy into the draft and modify it 
in order to ensure that the semantic focuses only the usage of Mobile IPv6.

As Jouni recognized in his recent review there are a couple of 
differences between the details of the authentication mechanism used by 
RFC 4285 and by RFC 4004.

Instead of re-using the MIP-MN-AAA-Auth AVP we need to carry the 
following values:
* Authenticator data value from MN-AAA auth option
* MAC_Mobility Data
since the following computation is done:
Authentication data = hash_fn(MN-AAA Shared key, MAC_Mobility Data)
MAC_Mobility Data = SHA1(care-of address | home address | MH Data)
* timestamp since this value may be used as input to the key derivation 
function.
* SPI value
* CoA since this value may be used as input to the key derivation function.

Thoughts?

Ciao
Hannes

PS: Thanks to Jouni for spending his time discussing these aspects with me.

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: "Giaretta, Gerardo" <[email-masked]>
Date: Tue, 4 Sep 2007 00:38:40 -0700

Hi Hannes,

Some comments inline...

> authorization and accounting is provided with Diameter.

I agree.

Moreover, there is another aspect that needs to be added and was pointed
out also by Vijay in MIP6 mailing list. The current AAA goals draft
needs to be updated in order to include the possibility for the HA to
check the IKEv2 PSK provided by the MN with the AAA server. 

This can be done either with a push method (AAA server pushing the PSK
to the HA) or with a pull method (HA asking the AAA server during the
IKEv2 exchange). We can discuss if we need two methods or just one of
them. The goal in draft-ietf-mip6-aaa-ha-goals will not point to a
specific solution but will state that the HA must be able to check the
validity of a PSK.

> in order to ensure that the semantic focuses only the usage of Mobile
IPv6.

Agree.

ciao
Gerardo

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 04 Sep 2007 09:48:52 +0200

Hi Gerardo,

Giaretta, Gerardo wrote:
> Hi Hannes,
>
> Some comments inline...
>
>   
>> Hi all,
>>
>> I read through the mobility documents and here is a suggested
>>     
> approach:
>   
>> certificate based authentication with the HA as well. In this mode
>>     
> only
>   
When you say PSK you do not mean the EAP method. Right?
If so, I assume you want to put the PSK into the User-Password AVP of 
NASREQ? Correct?

> IKEv2 exchange).
We don't have push methods in the document. Hence, we need to go for a 
pull method.

>  We can discuss if we need two methods or just one of
Ok.

Thanks for raising this issue.

Ciao
Hannes

>  
>   
>> The document currently references RFC 4004 with regard to the AVPs.
>>     
> The
>   
>> description of the AVPs in RFC 4004 often refers to the Mobile IPv4
>>     
> RFC
>   
>> with regard to the semantic. We should copy into the draft and modify
>>     
> it
>   
>> in order to ensure that the semantic focuses only the usage of Mobile
>>     
> IPv6.
>   
>
> Agree.
>
> ciao
> Gerardo
>
>   
>> differences between the details of the authentication mechanism used
>>     
> by
>   
>> * timestamp since this value may be used as input to the key
>>     
> derivation
>   
>> function.
>> * SPI value
>> * CoA since this value may be used as input to the key derivation
>>     
> function.
>   
>> Thoughts?
>>
>> Ciao
>> Hannes
>>
>> PS: Thanks to Jouni for spending his time discussing these aspects
>>     
> with me.
>

---

From: <[email-masked]>
Date: Tue, 4 Sep 2007 10:29:44 +0200

> Sent: Tuesday, September 04, 2007 10:49 AM

> > Moreover, there is another aspect that needs to be added and was 
> > pointed out also by Vijay in MIP6 mailing list. The current 
> AAA goals 
> > draft needs to be updated in order to include the 
> possibility for the 
> > HA to check the IKEv2 PSK provided by the MN with the AAA server.
> >   
> If so, I assume you want to put the PSK into the 
> User-Password AVP of NASREQ? Correct?

For IKEv2 you can have pre-shared keys also without EAP.
That needs to be covered as well.

> We don't have push methods in the document. Hence, we need to 
> go for a pull method.
> 
> >  We can discuss if we need two methods or just one of them. 
> The goal 
> > in draft-ietf-mip6-aaa-ha-goals will not point to a 
> specific solution 
> > but will state that the HA must be able to check the validity of a 
> > PSK.
> >   
> Ok.

Hmm check how?

Cheers,
	Jouni

---

From: "Giaretta, Gerardo" <[email-masked]>
Date: Tue, 4 Sep 2007 01:33:53 -0700

Hi Jouni,

> That needs to be covered as well.

Yes, I was referring to the PSK without EAP.
 
> > > but will state that the HA must be able to check the validity of a

This is part of the solution. As Hannes mentioned, so far we have only a
pull method for this. 

ciao
Gerardo