Subject: Re: [MOBILE-IP] Are Mobile-Home Authentication's optional ?

From: Patrice Calhoun <[email-masked]>
Date: Tue, 7 Mar 2000 08:47:10 -0800

One of the motivator, and features that AAA provides, is dynamic Home Agent
assignment. Further, the Home Agent can reside in the Foreign Domain.

So, MN-AAA can be seen as a replacement for MN-HA, when there is no static
security association between the MN and it's/an HA.

PatC
>Charles,
>
>  In the case the MN has security association with the FA ( MN-FA
>authentication extension used instead of MN-AAA),  I assume, MN-HA extension
>must be included in the message.
>   Regards
>    /Lila
>> -----Original Message-----
>> From: Woo-June Kim [SMTP:[email-masked]]
>> Sent: Tuesday, March 07, 2000 02:58
>> To:   [email-masked]
>> Subject:      Re: [MOBILE-IP] Are Mobile-Home Authentication's optional ?
>>
>> Charles
>>
>> Thanks. I guess I should read more carefully ! But, as I suggested in my
>> other e-mail, maybe the draft rfc2002-bis wording needs to be changed to
>> reflect the fact that MN-HA authentication is not a MUST now. (of course
>> some sort of authentication is still needed... see below)
>>
>> Anyway your answer brings more questions to my mind.
>>
>> The challenge/response draft says the MN-AAA authentication extension can
>> be removed by the FA after authentication is carried out by some means at
>> the FA. (by an AAA infra etc.)
>>
>> If the MN-AAA authentication is removed, and there is no MN-HA
>> authentication, by what means will the HA be able to authenticate the
>> message ? Are you not assuming that in such a case the MN-HA
>> authentication is used ?
>>
>> My understanding leads me to assume that in case either an MN-AAA
>> authentication or MN-HA authentication extension will always be in a
>> registration request received by the Home Agent. But the current wording
>> of the document seems to able to lead to cases where the FA implementation
>> could remove an MN-AAA authentication extension even when an MN-HA
>> authentication does not exist.
>>
>> Please correct me if I'm wrong again.
>> (by the way then I believe the wording of
>>
>> "..........
>>    Since the Challenge extension, and the authentication extension that
>>    is used by the Mobile Node to satisfy the challenge, both follow
>>    the Mobile-Home Authentication extension whenever the latter is
>>    present, the Foreign Agent MAY remove the Challenge Extension and
>>    the applicable authentication from the Registration Request without
>>    disturbing the authentication value computed by the Mobile Node for
>>    use by the Home Agent.
>> ........"
>>
>> should be changed (Is the first sentence grammatically correct ?)
>> to reflect the fact that the MN-AAA authentication can only be removed if
>> there is a MN-HA authentication extension.
>> )
>>
>> cheers
>>
>> Woojune Kim,
>> Senior Engineer
>> Samsung Electronics Ltd.
>> tel : +82-342-779-8526
>> hp : +82-11-368-7480
>> e-mail : [email-masked]
>>
>>
>> >
>> >Hello,
>> >
>> >Woo-June Kim wrote:
>> >
>> >> To me even if FAC is used, I don't quite see how it nullfies the need
>> for
>> >> the MN-HA authentication field.
>> >
>> >The Challenge specification was written after the MN-NAI specification,
>> >and the MN-NAI specification allows a MN-AAA authentication extension
>> >to take the place of the MN-HA authentication extension.
>> >
>> >Regards,
>> >Charlie P.
>> >

---

From: Vincent Magret <[email-masked]>
Date: Tue, 7 Mar 2000 11:06:32 -0600

> assignment. Further, the Home Agent can reside in the Foreign Domain.

Isn't this feature already available with Mobile IP?