Subject: RE: CLARIFICATION: Re: [mobile-ip] RFC3012bis-04 Available

From: "Kuntal Chowdhury" <[email-masked]>
Date: Mon, 6 Jan 2003 16:52:20 -0600

Hello Yoshi,

> Yoshiyuki Tsuda wrote:
>  You are missing my previous email.  I had meant that:
>  - MN-AAA authentication extension was intended to be used by an
>    AAA to authenticate an MN, and assign an HA, 

Disagree, MN-AAA auth extn is not meant for HA assignment by AAA.

> because the MN set
>    the HA field with 0.0.0.0 or 255.255.255.255 in the registration
>    request,

Please decouple the dynamic HA assignment by AAA discussion with the
discussion
about the need for MN-AAA and MN-FA in the same message.

>  - while the MN shared a security association with the FA.
> 
>  Also, I don't think adding the Mobile-Foreign authentication 
>  extension will waste the cdma2000 air resources too much.  
> It's  only 22 Bytes in about 106+ Byte IP packet. 
 
Respectfully disagree. Sending redundant information over the
air is bad regardless of the number of redundant bytes.

> And, 
> considering the  fact that the 2nd or later RRQs will contain 
> Mobile-Foreign auth.  ext. or MN-AAA auth. ext. with 
> Mobile-Home auth. ext., there is  no matter even if the 1st 
> RRQ will include Mobile-Foreign auth.  ext. with MN-AAA auth. 
> ext, I believe.  

I don't understand. Please clarify.

> I know your activities in 3GPP2 TSG-P, but 
> are all members in  that group claiming so ?
> 

I never said that, I was talking on behalf of 3GPP2. Nevertheless,
what is the relevance of this statement w.r.t. what we are 
discussing here?

>  Lastly, according to my experiences in attending on 
> bakeoffs,  adding that text will cause a big interoperating 
> problem with  existing FAs, I'm deeply afraid...
> 

Interoperability problem if the MN includes MN-AAA only! Not
sure how. Since you have mentioned about 3GPP2, the standard 
IS-835 uses MN-AAA (only) for all MIP access. Also a 3012
compliant FA must accept either MN-FA or MN-AAA auth extn.
from any MN.

Regards,
Kuntal

> Thanks.
> -Yoshi
> 
> at Mon, 6 Jan 2003 14:14:37 -0600, Kuntal Chowdhury wrote:
> >Charlie,
> >The entire discussion about allowing MN-FA and MN-AAA in the same 
> >registration request is based on scenarios that require the 
> FA to talk 
> >to AAA.The argument for allowing both these extensions is: 
> the MN may d
> esire
> >to get authenticated/authorized by the AAA server. If it is 
> allowed, it 
> >won't break anything. However, RFC3012bis will be largely used over 
> >wireless links. By sending redundant information (both MN-FA and 
> >MN-AAA), air resources will be wasted. Since we have the opportunity 
> >here (3012bis) to do the right thing, we should not allow 
> transmission 
> >of redundant information over the air by allowing both MN-FA and 
> >MN-AAA. The editorial work to clarify this will be pretty minor. I 
> >still think adding a sentence in the document to say "MN 
> SHOULD include 
> >MN-AAA only when it desires to be authenticated/authorized 
> by AAA" is a 
> >good idea.
> >
> >Regards,
> >Kuntal
> >
> >
> >> -----Original Message-----
> >> From: Charles E. Perkins [mailto:[email-masked]]
> >> Sent: Monday, January 06, 2003 1:03 PM
> >> To: Chowdhury, Kuntal [RICH1:2H18:EXCH]; Bharatia, Jayshree 
> >> [RICH1:2H13:EXCH]; [email-masked]'
> >> Subject: CLARIFICATION: Re: [mobile-ip] RFC3012bis-04 Available
> >> 
> >> 
> >> "Charles E. Perkins" wrote:
> >> 
> >> > >                I don't see the need for MN-FA authentication
> >> > > extension when MN-AAA auth extension is present.
> >> > 
> >> > The base Mobile IP specification requires it, so it has to be 
> >> > there.
> >> 
> >> I meant this in the context of the discussion when the mobile
> >> node shares a mobility security association with the foreign 
> >> agent.  Of course, the Mobile-Foreign extension is NOT 
> >> required when there is no such mobility security association.
> >> 
> >> Regards,
> >> Charlie P.
> >> 
>

---

From: "Robert J Marks" <[email-masked]>
Date: Mon, 6 Jan 2003 17:16:29 -0600

Hi Kuntal,

Regarding your statement (taken from your response below)

> Since you have mentioned about 3GPP2, the standard 
> IS-835 uses MN-AAA (only) for all MIP access.

I've searched IS-835-B, and I cannot find where the specification
prohibits inclusion of an MN-FA authentication extension, even if
an MN-AAA authentication extension is present.

Perhaps you can point me to the text which states this requirement.

Bob

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Kuntal Chowdhury
> Sent: Monday, January 06, 2003 4:52 PM
> To: Yoshiyuki Tsuda
> Cc: Charles E. Perkins; Jayshree Bharatia; 
> [email-masked]'; [email-masked]
> Subject: RE: CLARIFICATION: Re: [mobile-ip] RFC3012bis-04 Available
> 
> 
> Hello Yoshi,
> 
> > Yoshiyuki Tsuda wrote:

---

From: Yoshiyuki Tsuda <[email-masked]>
Date: Tue, 07 Jan 2003 19:24:19 +0900

Hello Kuntal,

at Mon, 6 Jan 2003 16:52:20 -0600, Kuntal Chowdhury wrote:
>Please decouple the dynamic HA assignment by AAA discussion
>with the discussion about the need for MN-AAA and MN-FA in
>the same message.

 OK.  They are different discussions.  But, please, don't
 cut my sentence as you like.  I know, MN-AAA auth. ext.
 is to authenticate an MN, and there is no field for an HA
 address in MN-AAA auth. ext.  So, MN-AAA auth. ext. isn't
 used to assign an HA address.

>air is bad regardless of the number of redundant bytes.

 Then, Charlie and I had pointed out there were cases that
 both extensions were necessary in the previous emails.
 We didn't mean it redundant.  Could you please let us know
 why you claim redundant ?

>I don't understand. Please clarify.

 About the 2nd or later registration request,
 - if an HA is assigned, the registration request must
   contain the Mobile-Home auth. ext. according to RFC3344.
 - We are now discussing about RFC3012; I assume an MN
   receives a challenge.  So, the registration request
   must contain the Mobile-Foreign auth. ext. or MN-AAA
   auth. ext.
 - Therefore, there are at least two auth. ext. in the 2nd
   or later registration request.

 So, I'd wanted to say that even if you reduced two auth.
 ext. to one auth. ext. at the 1st registration request,
 the reduction is just at the 1st round, and that the 2nd
 and later remained the same.

 But, you don't mind the number of bytes.  Then, you can
 skip above texts.

>what is the relevance of this statement w.r.t. what we are 

 Well, I felt you were talking on behald of 3GPP2, too.
 So, I'd just like to confirm whether all members in that
 group were claiming so or not.
 Actually, if a 3GPP2's MN doesn't share a security association
 with any FAs, there is no Mobile-Foreign auth. ext. in any
 registration requests.  Therefore, you don't have to warry
 about adding that text or not on behalf of 3GPP2.

Thanks.
-Yoshi