Subject: Re: [MOBILE-IP] Regional Registration Questions

From: Core Scott-P18750 <[email-masked]>
Date: Wed, 10 May 2000 15:08:10 -0700

Pat
I must have missed something. Why is it valuable to have the MN-FA security
association common to the MN-GFA association? If the MN moves to another FA,
the registration request must still be sent to the GFA to update the local
care-of-address (the new FA) so you don't save any registration time by
having the keying information at the FA. What did I miss.

scott

                >
                > Hello Pat,
                >
                > What would you say if the mobile node had a key that
worked
                > with both the GFA and the FA simultaneously?  In other
words,
                > what if the mobile node had a MN<-->*FA security
association?
                > Presumably, the GFA could pass the MN<-->*FA security
                > association along to any foreign agent in the same domain.

                What would I say? I would say that it would make me REALLY
happy! This
                simplification would really benefit the I-D.

                >
                > Of course, any suggestions about simplifying the protocol
                > will be appreciated.
                So, it sounds like what is needed is when the GFA receives
the keying
                information from the AAA infrastructure, it is able to
forward the keys to the
                FA. This *could* be done by using the Foreign Agent blob
extensions, or
                through some other yet to be defined extension.

                When the FA receives the RegReq, if the MN-AAA is not
present, it could then
                authenticate the MN-FA. This ensures security throughout the
whole path, and
                minimizes the number of security associations.

                Perfect!

                PatC
                >
                > Regards,
                > Charlie P.
                >
                >
                >
                > "[email-masked]" wrote:
                > >
                > > I have a couple of last questions, and assumptions
regarding the above draft.
                > >
                > > First, I am assuming that the *dynamic* security
associations that get created
                > > as a result of AAA are as follows (communication path is
shown by single line,
                > > while SAs are shown by double lines):
                > >
                > >          +=========================+
                > >         ||                         ||
                > >         MN =========+              ||
                > >         |           ||             ||
                > >         |           ||             ||
                > >         |           ||             ||
                > >         FA---------GFA ========== HA
                > >                     |              |
                > >                     |              |
                > >                     |              |
                > >                    AAAF-----------AAAH
                > >
                > > This means that the Mobile Node gets keying information
that it would use to
                > > authenticate MN-GFA messages, and the GFA would auth
with the MN and the HA.
                > > Of course, the MN would also create the MN-HA auth ext.
                > >
                > > So, the FA should NEVER have a security association with
the HA, right? And
                > > furthermore, the MN should NEVER have a security
association with the FA,
                > > right? If not, please let me know why. The idea of the
MN share an SA with
                > > both the FA and the GFA seems odd. First, they are owned
by the same
                > > administrative domain, so they trust themselves, and it
reduces the overhead
                > > and complexity of the protocol.
                > >
                > > Am I wrong?
                > >
                > > PatC

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 10 May 2000 15:14:10 -0700

> having the keying information at the FA. What did I miss.

Of course, this would be dependent upon one of the hand-off proposals, that
would allow the old FA to exchange keying information to the new FA. However,
I do see your point, that simply supporting Regional Registration would make
it really difficult for the new FA to retrieve the necessary keying
information without any additional support.

PatC

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 10 May 2000 15:15:39 -0700

Actually, now that I think of it more, one of the Internet Drafts that I
co-authored defines an extension that allows the Mobile Node to carry the
keying information as opaque data. This would work very well.

PatC