Subject: Re: [MOBILE-IP] FW: Clarification of draft-ietf-mobileip-challenge-09.txt

From: Woo-June Kim <[email-masked]>
Date: Tue, 4 Apr 2000 05:40:27 +0900

Paul,

This was a question I brought up a couple of weeks back on the mailing list. I agree with you that the wording does seem to be a bit unclear. But in the end the basic gist is that the MN-AAA authentication can replace the MN-HA authentication as it can be assumed that the HA will normally either  have or be able to dynamically establish a trust relationship with the AAA. Consequently only one of these need appear in the registration request. (Or course both could as well, though it would be redundant.) Note that the result here is that both the FA and the HA can authenticate the request.

cheers

Woojune Kim,
Senior Engineer
Samsung Electronics Ltd. 
tel : +82-342-779-8526
hp : +82-11-368-7480
e-mail : [email-masked]

>> Hello,
>>
>>     In Section 6 - MN-AAA Authentication subtype, the following statement
>> is made:
>>
>> " If the MN-AAA Authentication extension is present, then the Registration
>> Message MAY be sent by the mobile node without containing the Mobile-HA
>> Authentication extension [12]."
>>
>> RFC 2002 states in Section 3.5.2 that the Mobile-Home Authentication
>> Extension MUST be present in all Registration Requests and Registration
>> Replies. I assume that the draft must conform to 2002.
>>
>>
>> P. Evans, ing.
>> /// Research Canada
>>
>

---

From: Frank Paehlke <[email-masked]>
Date: Tue, 4 Apr 2000 11:00:30 +0200

Hello,

when thinking about this issue, it came to my mind that perhaps the best
solution would be the following one:

In registration requests:
        MN-HA must be present, MN-AAA auth. is an optional addition
In registration replies:
        either one of MN-HA auth. or MN-AAA auth. must be present

The first statement assures that every registration request can be
processed even if the FA does not support fast handoff (in this case,
the FA can process the request and forward it to the HA as usual).
The second statement makes fast handoff possible if supported by the FA.

Just thinking aloud...

Cheers,
Frank

--
Frank Paehlke
Institut fuer Telematik       Phone: +49 721 608-6398
Universitaet Karlsruhe (TH)   Fax:   +49 721 388097
D-76128 Karlsruhe, Germany    EMail: [email-masked]

---

From: "[email-masked]" <[email-masked]>
Date: Tue, 4 Apr 2000 07:51:24 -0700

> The second statement makes fast handoff possible if supported by the FA.

Perhaps I am missing something, but I fail to understand how hand-off could
be achieved if either MN-HA or MN-AAA auth is present. In either case, the FA
cannot process that auth req.

Could you elaborate?

PatC