Subject: Re: [MOBILE-IP] challenge / response; MN auth timeout

From: Patrice Calhoun <[email-masked]>
Date: Tue, 25 Jan 2000 07:09:07 -0800

>Hello, Karim and Pat,
>
> My comment and my new concerning are embedded:
>
>On Mon, 24 Jan 2000 13:50:13 +0100,  Karim El-Malki (ERA) wrote:
>>> Hi Yoshi
>>>
>>> >   The HA or FA knows the SA will expire at t-expire, so, Tprev cannot
>>> >   be longer than t-expire - t-prev.  Therefore, logically there is the
>>> >   first accepted life time(Tprev), which coincides with the
>>> >  end of Tsa.
>>> >
>>> >   After this happens, all successive acceptable life time
>>> >  will coincide
>>> >   with the end of Tsa.
>>> >
>>> >   In practice, I should say these are closely coincided, I think.
>>>
>>> In this you assume that the SA will last only for one MN Registration
>>> lifetime. As Charlie mentioned in a previous email, it is normal to
>>> expect the SA to last many Registration lifetimes. Therefore the MN
>>> must have a way to understand when it is to use the MN-AAA extension
>>> to re-establish the SA (as Tomas pointed out). Please correct me if
>>> I misunderstood your point.
>
> I was assuming an SA lifetime is multiple times of MN Registration lifetime
> from the beginning...
>
> But, judging from the last Pat's email, they have already come to a consensus
> to add a lifetime field in the expired draft-ietf-mobileip-aaa-key-00.txt.
> This solution may be better than mine, I agree.
>
> But, there is a new problem to this solution:
> If an MN receives an SA lifetime, the MN must keep the SA until the lifetime
> is expired.  This means in some cases an MN must keep too many SAs.  If an MN
> visits many subnets, and if their SA lifetimes are long, SAs to be kept will
> soon grow more than an MN's ability.
>
> I will appreciate, if there is a method about re-getting or re-newing
> keying information with its lifetime.  If there is such a method, an MN can
> abandon some old SAs before being expired.  Winthout such a method, if an
> MN abandons an SA between the MN and an FA, an MN cannot anymore register the
> FA whose SA the MN had abandon before, because the FA knows there is an SA
> between the FA and the MN.
>
> Or, am I missing some sentences ?

Yes, the fact that the Mobile Node can simply request new keying material
by including the MN-AAA Authentication Extension in the Registration
Request. This needs to be supported since we do not know that a Mobile Node
no longer has an SA because of laziness, or due to a host reboot.

PatC
>
>Thanks.
>-Yoshi
>
>
>>> Given these discussions, it may be appropriate for people who are
>>> implementing the Challenge/Response draft if it identified the cases
>>> in which the MN-AAA extension may be used:
>>>
>>> - Expiry of SA (regkey lifetime expiry or BAD_AUTHENTICATION)
>>> - Change of COA
>>>
>>> Regards,
>>> Karim