Subject: Re: [MOBILE-IP] Are Mobile-Home Authentication's optional ?

From: Patrice Calhoun <[email-masked]>
Date: Tue, 7 Mar 2000 08:52:17 -0800

Since the HA inherently trusts its AAA server (and if it doesn't then we have
a problem), if the AAAH states that the Mobile Node was authenticated, why
does the HA have to also authenticate the user?

Further, if we mandate MN-HA, then we need to push the Mobile Node's secret to
the HA, and if the HA lives in a non-trusted domain (e.g. HA in foreign
domain), why would you want to provide the MN's password to it?

PatC
>>
>>Anyway your answer brings more questions to my mind.
>>
>>The challenge/response draft says the MN-AAA authentication extension can be
>removed by the FA after authentication is carried out by some means at the FA.
>(by an AAA infra etc.)
>>
>
>Woo, I agree with you.
>
>Charlie,
>
>To add even if the MN-AAA is not removed, since the HA will not authenticate
>based of HA-AAA, how will the
>HA authenticate the MN? Is the assumption that HA will be instructed to by the
>HAAA to accept the MN? (Note: I am not
>sure if this is good or bad.  I would like to understand the motivation for the
>Statement about HA-MN being optional).
>
>Thanks
>Gopal
>
>
>>If the MN-AAA authentication is removed, and there is no MN-HA authentication,
>by what means will the HA be able to authenticate the message ? Are you not
>assuming that in such a case the MN-HA authentication is used ?
>>
>>My understanding leads me to assume that in case either an MN-AAA
>authentication or MN-HA authentication extension will always be in a
>registration request received by the Home Agent. But the current wording of the
>document seems to able to lead to cases where the FA implementation could remove
>an MN-AAA authentication extension even when an MN-HA authentication does not
>exist.
>>
>>Please correct me if I'm wrong again.
>>(by the way then I believe the wording of
>>
>>"..........
>>   Since the Challenge extension, and the authentication extension that
>>   is used by the Mobile Node to satisfy the challenge, both follow
>>   the Mobile-Home Authentication extension whenever the latter is
>>   present, the Foreign Agent MAY remove the Challenge Extension and
>>   the applicable authentication from the Registration Request without
>>   disturbing the authentication value computed by the Mobile Node for
>>   use by the Home Agent.
>>........"
>>
>>should be changed (Is the first sentence grammatically correct ?)
>>to reflect the fact that the MN-AAA authentication can only be removed if there
>is a MN-HA authentication extension.
>>)
>>
>>cheers
>>
>>Woojune Kim,
>>Senior Engineer
>>Samsung Electronics Ltd.
>>tel : +82-342-779-8526
>>hp : +82-11-368-7480
>>e-mail : [email-masked]
>>
>>
>>>
>>>Hello,
>>>
>>>Woo-June Kim wrote:
>>>
>>>> To me even if FAC is used, I don't quite see how it nullfies the need for
>>>> the MN-HA authentication field.
>>>
>>>The Challenge specification was written after the MN-NAI specification,
>>>and the MN-NAI specification allows a MN-AAA authentication extension
>>>to take the place of the MN-HA authentication extension.
>>>
>>>Regards,
>>>Charlie P.
>>>
>>
>Thank You.
>Regards,
>Gopal
>-------------------------------------------------------------------------------------------------------------
>
>Gopal Dommety
>408 525 1404
>[email-masked]
>Cisco Systems, San Jose, CA, 95051

---

From: Tom Weckström <[email-masked]>
Date: Tue, 7 Mar 2000 23:32:05 +0200

Pat,

This is just nitpicking about your trust statement...

80% - or even 90% of security attacks tend to come from inside. I would
not state that HA trusts AAAH inherently without any security
associations (i.e. shared secrets, public key systems, certificates,...)
It would be far too easy to play HA or AAAH inside the Home Network, if
no verification mechanism for the trust relationship existed.

Regards,
         Tom

--
        Tom Weckström           [email-masked]