Subject: [AAA-WG]: Key generation for MobileIP?

From: "Martin Julien (ECE)" <[email-masked]>
Date: Fri, 9 Mar 2001 16:27:37 +0100

Hi,

In section 5.3 from "draft-ietf-aaa-diameter-mobileip-01.txt", it says that:

"If the home agent is in the home domain, then AAAH has to generate
 the Foreign-Home registration key.  Otherwise, it is generated by
 AAAF."

However, the rest of the section seems to suggest that the key generation
should be performed in the AAAH. Can it be made clearer in the draft? I
am confused about what should be done exactly, since my understanding was
that keys should always be generated in the AAAH. Does the AAAH need to 
keep track of the registration keys for each session? Who should enforce 
the Authorization-Lifetime between the AAAH and the AAAF?

Regards,
Martin

---

From: Pat Calhoun <[email-masked]>
Date: Fri, 9 Mar 2001 07:36:47 -0800 (PST)

> should be performed in the AAAH. Can it be made clearer in the draft? 

Interestingly enough, we did have a discussion about this, and I somehow forgot
to include it in my report earlier today. It became clear at the meeting that
the text discussing who generates the FA-HA keys is confusing when the HA is
in the visited network, and does in fact need to be clarified.

> I
> keep track of the registration keys for each session? 

What do you mean by keep track? In any case, the AAAF generates the FA-HA keys
when the HA is in the visited domain. However, if the HA is in a third domain
(which occurs when the HA is allocated in a visited domain, and the user roams
to another domain), the AAAH needs to allocate the keys.

An alternative is to have the AAAH always allocate the keys, but when the HA is
in the visited domain, the AAAF can overwrite those keys with its own set.

> Who should enforce 

Not sure I understand the question. The AAAH has the final say on the 
Authorization-Lifetime, however what I noticed at the bakeoff was that if such
an AVP was present in the AMR from the FA or AAAF, the AAAH would only
override this value if it's Authorization-Lifetime was smaller than the value
received. It would never set the Authorization-Lifetime to a value greater
than what was received.

PatC