Subject: Re: [MOBILE-IP] Are Mobile-Home Authentication's optional ?

From: "Lila Madour (LMC)" <[email-masked]>
Date: Tue, 7 Mar 2000 08:06:38 -0500

Charles,

  In the case the MN has security association with the FA ( MN-FA
authentication extension used instead of MN-AAA),  I assume, MN-HA extension
must be included in the message.
   Regards
    /Lila
> -----Original Message-----
> From: Woo-June Kim [SMTP:[email-masked]]
> Sent: Tuesday, March 07, 2000 02:58
> To:   [email-masked]
> Subject:      Re: [MOBILE-IP] Are Mobile-Home Authentication's optional ?
>
> Charles
>
> Thanks. I guess I should read more carefully ! But, as I suggested in my
> other e-mail, maybe the draft rfc2002-bis wording needs to be changed to
> reflect the fact that MN-HA authentication is not a MUST now. (of course
> some sort of authentication is still needed... see below)
>
> Anyway your answer brings more questions to my mind.
>
> The challenge/response draft says the MN-AAA authentication extension can
> be removed by the FA after authentication is carried out by some means at
> the FA. (by an AAA infra etc.)
>
> If the MN-AAA authentication is removed, and there is no MN-HA
> authentication, by what means will the HA be able to authenticate the
> message ? Are you not assuming that in such a case the MN-HA
> authentication is used ?
>
> My understanding leads me to assume that in case either an MN-AAA
> authentication or MN-HA authentication extension will always be in a
> registration request received by the Home Agent. But the current wording
> of the document seems to able to lead to cases where the FA implementation
> could remove an MN-AAA authentication extension even when an MN-HA
> authentication does not exist.
>
> Please correct me if I'm wrong again.
> (by the way then I believe the wording of
>
> "..........
>    Since the Challenge extension, and the authentication extension that
>    is used by the Mobile Node to satisfy the challenge, both follow
>    the Mobile-Home Authentication extension whenever the latter is
>    present, the Foreign Agent MAY remove the Challenge Extension and
>    the applicable authentication from the Registration Request without
>    disturbing the authentication value computed by the Mobile Node for
>    use by the Home Agent.
> ........"
>
> should be changed (Is the first sentence grammatically correct ?)
> to reflect the fact that the MN-AAA authentication can only be removed if
> there is a MN-HA authentication extension.
> )
>
> cheers
>
> Woojune Kim,
> Senior Engineer
> Samsung Electronics Ltd.
> tel : +82-342-779-8526
> hp : +82-11-368-7480
> e-mail : [email-masked]
>
>
> >
> >Hello,
> >
> >Woo-June Kim wrote:
> >
> >> To me even if FAC is used, I don't quite see how it nullfies the need
> for
> >> the MN-HA authentication field.
> >
> >The Challenge specification was written after the MN-NAI specification,
> >and the MN-NAI specification allows a MN-AAA authentication extension
> >to take the place of the MN-HA authentication extension.
> >
> >Regards,
> >Charlie P.
> >

---

From: Patrice Calhoun <[email-masked]>
Date: Wed, 8 Mar 2000 06:03:11 -0800

My appologies, inherently trusts in no way meant, at least to me, that no
security associations are needed between two nodes. I believe, and the AAA
protocol that I have in mind, that AAA does require security (even within a
network).

What I meant, however, was that a HOme Agent can trust that if it's AAAH
server states that a Mobile Node is authenticated, it doesn't have to
worry about the AAAH performing fraud.

PatC
>Pat,
>
>This is just nitpicking about your trust statement...
>
>80% - or even 90% of security attacks tend to come from inside. I would
>not state that HA trusts AAAH inherently without any security
>associations (i.e. shared secrets, public key systems, certificates,...)
>It would be far too easy to play HA or AAAH inside the Home Network, if
>no verification mechanism for the trust relationship existed.
>
>Regards,
>         Tom
>
>
>Patrice Calhoun wrote:
>>
>> Since the HA inherently trusts its AAA server (and if it doesn't then we have
>> a problem), if the AAAH states that the Mobile Node was authenticated, why
>> does the HA have to also authenticate the user?
>>
>> Further, if we mandate MN-HA, then we need to push the Mobile Node's secret
>to
>> the HA, and if the HA lives in a non-trusted domain (e.g. HA in foreign
>> domain), why would you want to provide the MN's password to it?
>>
>> PatC
>> >>
>be
>> >removed by the FA after authentication is carried out by some means at the
>FA.
>> >(by an AAA infra etc.)
>> >>
>> >
>> >Woo, I agree with you.
>> >
>> >Charlie,
>> >
>> >To add even if the MN-AAA is not removed, since the HA will not authenticate
>> >based of HA-AAA, how will the
>> >HA authenticate the MN? Is the assumption that HA will be instructed to by
>the
>> >HAAA to accept the MN? (Note: I am not
>> >sure if this is good or bad.  I would like to understand the motivation for
>the
>> >Statement about HA-MN being optional).
>> >
>> >Thanks
>> >Gopal
>> >
>> >
>authentication,
>> >by what means will the HA be able to authenticate the message ? Are you not
>> >assuming that in such a case the MN-HA authentication is used ?
>> >>
>> >registration request received by the Home Agent. But the current wording of
>the
>> >document seems to able to lead to cases where the FA implementation could
>remove
>> >an MN-AAA authentication extension even when an MN-HA authentication does
>not
>> >exist.
>> >>
>> >Thank You.
>> >Gopal
>>-------------------------------------------------------------------------------------------------------------
>> >
>> >Gopal Dommety
>> >408 525 1404
>> >[email-masked]
>> >Cisco Systems, San Jose, CA, 95051
>
>--
>        Tom Weckström           [email-masked]