Subject: RE: CLARIFICATION: Re: [mobile-ip] RFC3012bis-04 Available

From: "Ahmad Muhanna" <[email-masked]>
Date: Tue, 7 Jan 2003 10:38:53 -0600

Hello all,
Sorry for the late comments on this issue.

I would like to point out that so far and after reading all comments
posted to this thread, I have NOT seen any valid scenario that requires 
both the MN-AAA and MN-FA auth. extensions to exist at the same time in 
any RRQ message.

Let us remember, the current RFC3012-bis text requires the use of MN-AAA
auth. extension
ONLY if there is no security association between the MN and the visited FA.
To change
this, we need to see real scenarios which may require changing the text.
Also let us visit the following text in RFC3012, RFC3012-bis, section 3.2:

   Furthermore, the Foreign Agent MUST check that there is either a
   Mobile-Foreign, or a Mobile-AAA Authentication extension after
   the Challenge extension.  Any registration message containing
   the Challenge extension without either of these authentication
   extensions MUST be silently discarded.  If the registration
   message contains a Mobile-Foreign Authentication extension with an
   incorrect authenticator that fails verification, the Foreign Agent
   MAY send a Registration Reply to the mobile node with Code value
   BAD_AUTHENTICATION (see Section 10).

Let us agree on the following:

1. It does not make sense, at least to me, to assume that a Mobile Node
possibly have 
a security association with a FA and at the same time it does not know its
Home Agent. 
In other words, during Dynamic HA assignment, I do not believe that it is
feasible
for the MN to already have established a security association some how with
the FA
it is visiting before knowing its HA. 
"Although.. It is almost required to have a SA with the home domain AAA"

2. In subsequent registration request, i. e. Re-registration request, I do
not see
the value of having the MN-AAA and the MN-FA authentication extension in the
same RRQ. 
If there is a mechanism to establish the SA between the MN and the FA during
the initial 
registration, I believe having the MN-FA auth extension ALONE in preferred.
It saves time!!!
Otherwise, MN can continue to use MN-AAA auth. extension. 

Regards;
Ahmad Muhanna

---

From: Yoshiyuki Tsuda <[email-masked]>
Date: Wed, 08 Jan 2003 08:09:23 +0900

Hello Ahmad,

>both the MN-AAA and MN-FA auth. extensions to exist at the same time in 

 Which scenario have you checked ?
 And please tell me why you claim they are invalid.
 Are you willing to say Charlie's scenario is invalid, too ?
 Because, I'm afraid you might not follow all comments, see below.

>this, we need to see real scenarios which may require changing the text.

 Please, point me where the above related text is in RFC3012bis-04
 of IETF MIP homepage.  I've read it once again, but I couldn't
 find such texts.
 Or, have you just added such texts to RFC3012bis-04 ???

>   BAD_AUTHENTICATION (see Section 10).

 I believe the above text won't prohibit both extensions.

 And, please, read the 3.1 section in RFC3012bis.  Then,
 I hope you can agree with us.

>"Although.. It is almost required to have a SA with the home domain AAA"

 At the previous email, Kuntal had pointed out
 they were separate discussions, and I've already
 agreed at the previous email.  So, please, don't
 repeat it again here.

>Otherwise, MN can continue to use MN-AAA auth. extension. 

 So far I have never mentioned that there was a
 case where both Mobile-Foreign auth. ext. and
 MN-AAA auth. ext. are required in the subsequent
 registration request. :(

Thanks.
-Yoshi