Subject: Re: [MOBILE-IP] challenge / response; MN auth timeout

From: "Karim El-Malki (ERA)" <[email-masked]>
Date: Mon, 24 Jan 2000 13:50:13 +0100

Hi Yoshi

>   The HA or FA knows the SA will expire at t-expire, so, Tprev cannot
>   be longer than t-expire - t-prev.  Therefore, logically there is the
>   first accepted life time(Tprev), which coincides with the
>  end of Tsa.
>
>   After this happens, all successive acceptable life time
>  will coincide
>   with the end of Tsa.
>
>   In practice, I should say these are closely coincided, I think.

In this you assume that the SA will last only for one MN Registration
lifetime. As Charlie mentioned in a previous email, it is normal to
expect the SA to last many Registration lifetimes. Therefore the MN
must have a way to understand when it is to use the MN-AAA extension
to re-establish the SA (as Tomas pointed out). Please correct me if
I misunderstood your point.

Given these discussions, it may be appropriate for people who are
implementing the Challenge/Response draft if it identified the cases
in which the MN-AAA extension may be used:

- Expiry of SA (regkey lifetime expiry or BAD_AUTHENTICATION)
- Change of COA

Regards,
Karim

---

From: Yoshiyuki Tsuda <[email-masked]>
Date: Tue, 25 Jan 2000 11:34:50 +0900

Hello, Karim and Pat,

 My comment and my new concerning are embedded:

>> I misunderstood your point.

 I was assuming an SA lifetime is multiple times of MN Registration lifetime
 from the beginning...

 But, judging from the last Pat's email, they have already come to a consensus
 to add a lifetime field in the expired draft-ietf-mobileip-aaa-key-00.txt.
 This solution may be better than mine, I agree.

 But, there is a new problem to this solution:
 If an MN receives an SA lifetime, the MN must keep the SA until the lifetime
 is expired.  This means in some cases an MN must keep too many SAs.  If an MN
 visits many subnets, and if their SA lifetimes are long, SAs to be kept will
 soon grow more than an MN's ability.

 I will appreciate, if there is a method about re-getting or re-newing
 keying information with its lifetime.  If there is such a method, an MN can
 abandon some old SAs before being expired.  Winthout such a method, if an
 MN abandons an SA between the MN and an FA, an MN cannot anymore register the
 FA whose SA the MN had abandon before, because the FA knows there is an SA
 between the FA and the MN.

 Or, am I missing some sentences ?

Thanks.
-Yoshi