Subject: Re: [MOBILE-IP] Are Mobile-Home Authentication's optional ?

From: Woo-June Kim <[email-masked]>
Date: Tue, 7 Mar 2000 16:57:50 +0900

Charles

Thanks. I guess I should read more carefully ! But, as I suggested in my other e-mail, maybe the draft rfc2002-bis wording needs to be changed to reflect the fact that MN-HA authentication is not a MUST now. (of course some sort of authentication is still needed... see below)

Anyway your answer brings more questions to my mind.

The challenge/response draft says the MN-AAA authentication extension can be removed by the FA after authentication is carried out by some means at the FA. (by an AAA infra etc.)

If the MN-AAA authentication is removed, and there is no MN-HA authentication, by what means will the HA be able to authenticate the message ? Are you not assuming that in such a case the MN-HA authentication is used ? 

My understanding leads me to assume that in case either an MN-AAA authentication or MN-HA authentication extension will always be in a registration request received by the Home Agent. But the current wording of the document seems to able to lead to cases where the FA implementation could remove an MN-AAA authentication extension even when an MN-HA authentication does not exist.

Please correct me if I'm wrong again.
(by the way then I believe the wording of 

"..........
   Since the Challenge extension, and the authentication extension that
   is used by the Mobile Node to satisfy the challenge, both follow
   the Mobile-Home Authentication extension whenever the latter is
   present, the Foreign Agent MAY remove the Challenge Extension and
   the applicable authentication from the Registration Request without
   disturbing the authentication value computed by the Mobile Node for
   use by the Home Agent.
........"

should be changed (Is the first sentence grammatically correct ?)
to reflect the fact that the MN-AAA authentication can only be removed if there is a MN-HA authentication extension.
)

cheers

Woojune Kim,
Senior Engineer
Samsung Electronics Ltd. 
tel : +82-342-779-8526
hp : +82-11-368-7480
e-mail : [email-masked]

>
>Hello,
>
>Woo-June Kim wrote:
>
>> To me even if FAC is used, I don't quite see how it nullfies the need for
>> the MN-HA authentication field.
>
>The Challenge specification was written after the MN-NAI specification,
>and the MN-NAI specification allows a MN-AAA authentication extension
>to take the place of the MN-HA authentication extension.
>
>Regards,
>Charlie P.
>

---

From: Gopal Dommety <[email-masked]>
Date: Tue, 7 Mar 2000 08:57:05 -0800

>The challenge/response draft says the MN-AAA authentication extension can be removed by the FA after authentication is carried out by some means at the FA. (by an AAA infra etc.)

Woo, I agree with you.

Charlie,

To add even if the MN-AAA is not removed, since the HA will not authenticate based of HA-AAA, how will the
HA authenticate the MN? Is the assumption that HA will be instructed to by the HAAA to accept the MN? (Note: I am not
sure if this is good or bad.  I would like to understand the motivation for the Statement about HA-MN being optional).

Thanks
Gopal

>(by the way then I believe the wording of
Thank You.
Regards,
Gopal
-------------------------------------------------------------------------------------------------------------

Gopal Dommety
408 525 1404
[email-masked]
Cisco Systems, San Jose, CA, 95051