Subject: RE: CLARIFICATION: Re: [mobile-ip] RFC3012bis-04 Available

From: "Kuntal Chowdhury" <[email-masked]>
Date: Mon, 6 Jan 2003 18:27:34 -0600

Bob,
I do not like to discuss matters concerning other standards on IETF
discussion list. The example that I gave (IS-835) was just an example and
should not be considered as the main point of discussion, nor to be used to
prove anything.

The main question is: should 3012bis allow both MN-FA and MN-AAA auth
extensions to be present in the same registration request? I think: No. The
reason is: we need to avoid sending redundant information over the air. The
MN should know that one auth extension is required in the registration
request. We should allow the MN to decide which one to use based on it's
specific need (such as its desire to authenticate/authorize with the AAA
server). The FA should not care which one the MN uses as long as it is able
to authenticate the user.

Regards,
Kuntal

> -----Original Message-----
> From: Robert J Marks [mailto:[email-masked]] 
> Sent: Monday, January 06, 2003 5:56 PM
> To: Chowdhury, Kuntal [RICH1:2H18:EXCH]; 'Yoshiyuki Tsuda'
> Cc: 'Charles E. Perkins'; Bharatia, Jayshree 
> [RICH1:2H13:EXCH]; [email-masked]
> Subject: RE: CLARIFICATION: Re: [mobile-ip] RFC3012bis-04 Available
> 
> 
> Hi Kuntal,
> 
> Kuntal Chowdhury wrote:
> > 
> > Bob,
> > The standard does not prohibit the use of MN-FA auth extn.,
> > and I didn't say
> > that it prohibited the use of MN-FA extn. It does not even 
> > talk about MN-FA
> > auth extn. However the standard makes use of only MN-AAA for 
> > MIP access.
> > It's written all over chapter 6.
> 
> OK. IS-835 specifies what to do with the MN-AAA extension, 
> and leaves specification of what to do with the MN-FA 
> extension to existing (or soon to be published) IETF standards.
> 
> Since both extensions may be present, even according to 
> IS-835, it is appropriate for 3012bis to include guidance 
> when both are present.
> 
> Bob
>   
> > 
> > Regards,
> > Kuntal
> > 
> > 
> > > -----Original Message-----
> > > From: Robert J Marks [mailto:[email-masked]]
> > > Sent: Monday, January 06, 2003 5:16 PM
> > > To: Chowdhury, Kuntal [RICH1:2H18:EXCH]; 'Yoshiyuki Tsuda'
> > > Cc: 'Charles E. Perkins'; Bharatia, Jayshree 
> > > [RICH1:2H13:EXCH]; [email-masked]; [email-masked]
> > > Subject: RE: CLARIFICATION: Re: [mobile-ip] RFC3012bis-04 
> Available
> > > 
> > > 
> > > Hi Kuntal,
> > > 
> > > Regarding your statement (taken from your response below)
> > > 
> > > > Since you have mentioned about 3GPP2, the standard
> > > > IS-835 uses MN-AAA (only) for all MIP access.
> > > 
> > > I've searched IS-835-B, and I cannot find where the
> > > specification prohibits inclusion of an MN-FA authentication 
> > > extension, even if an MN-AAA authentication extension is present.
> > > 
> > > Perhaps you can point me to the text which states this 
> requirement.
> > > 
> > > Bob
> > > 
> > > > -----Original Message-----
> > > > From: [email-masked]
> > > > [mailto:[email-masked]] On Behalf Of
> > > > Kuntal Chowdhury
> > > > Sent: Monday, January 06, 2003 4:52 PM
> > > > To: Yoshiyuki Tsuda
> > > > Cc: Charles E. Perkins; Jayshree Bharatia; 
> > > > [email-masked]'; [email-masked]
> > > > Subject: RE: CLARIFICATION: Re: [mobile-ip] RFC3012bis-04 
> > Available
> > > > 
> > > > 
> > > > Hello Yoshi,
> > > > 
> > > > > Yoshiyuki Tsuda wrote:
> > > > >  You are missing my previous email.  I had meant that:
> > > > >  - MN-AAA authentication extension was intended to be 
> used by an
> > > > >    AAA to authenticate an MN, and assign an HA,
> > > > 
> > > > Disagree, MN-AAA auth extn is not meant for HA 
> assignment by AAA.
> > > > 
> > > > > because the MN set
> > > > >    the HA field with 0.0.0.0 or 255.255.255.255 in the
> > > registration
> > > > >    request,
> > > > 
> > > > Please decouple the dynamic HA assignment by AAA discussion
> > > with the
> > > > discussion about the need for MN-AAA and MN-FA in the
> > same message.
> > > > 
> > > > >  - while the MN shared a security association with the FA.
> > > > > 
> > > > >  Also, I don't think adding the Mobile-Foreign 
> authentication  
> > > > > extension will waste the cdma2000 air resources too much.
> > > > > It's  only 22 Bytes in about 106+ Byte IP packet. 
> > > >  
> > > > Respectfully disagree. Sending redundant information over
> > > the air is
> > > > bad regardless of the number of redundant bytes.
> > > > 
> > > > > And,
> > > > > considering the  fact that the 2nd or later RRQs will contain
> > > > > Mobile-Foreign auth.  ext. or MN-AAA auth. ext. with 
> > > > > Mobile-Home auth. ext., there is  no matter even if the 1st 
> > > > > RRQ will include Mobile-Foreign auth.  ext. with MN-AAA auth. 
> > > > > ext, I believe.  
> > > > 
> > > > I don't understand. Please clarify.
> > > > 
> > > > > I know your activities in 3GPP2 TSG-P, but
> > > > > are all members in  that group claiming so ?
> > > > > 
> > > > 
> > > > I never said that, I was talking on behalf of 3GPP2.
> > Nevertheless,
> > > > what is the relevance of this statement w.r.t. what we are
> > > discussing
> > > > here?
> > > > 
> > > > >  Lastly, according to my experiences in attending on 
> bakeoffs,  
> > > > > adding that text will cause a big interoperating 
> problem with  
> > > > > existing FAs, I'm deeply afraid...
> > > > > 
> > > > 
> > > > Interoperability problem if the MN includes MN-AAA only!
> > > Not sure how.
> > > > Since you have mentioned about 3GPP2, the standard IS-835
> > > uses MN-AAA
> > > > (only) for all MIP access. Also a 3012 compliant FA must
> > > accept either
> > > > MN-FA or MN-AAA auth extn. from any MN.
> > > > 
> > > > Regards,
> > > > Kuntal
> > > > 
> > > > 
> > > > > Thanks.
> > > > > -Yoshi
> > > > > 
> > > > > at Mon, 6 Jan 2003 14:14:37 -0600, Kuntal Chowdhury wrote:
> > > > > >Charlie,
> > > > > >The entire discussion about allowing MN-FA and MN-AAA
> > in the same
> > > > > >registration request is based on scenarios that require the
> > > > > FA to talk
> > > > > >to AAA.The argument for allowing both these extensions is:
> > > > > the MN may d
> > > > > esire
> > > > > >to get authenticated/authorized by the AAA server. If it is
> > > > > allowed, it
> > > > > >won't break anything. However, RFC3012bis will be largely
> > > > used over
> > > > > >wireless links. By sending redundant information (both
> > MN-FA and
> > > > > >MN-AAA), air resources will be wasted. Since we have the
> > > > opportunity
> > > > > >here (3012bis) to do the right thing, we should not allow
> > > > > transmission
> > > > > >of redundant information over the air by allowing both
> > MN-FA and
> > > > > >MN-AAA. The editorial work to clarify this will be
> > > pretty minor. I
> > > > > >still think adding a sentence in the document to say "MN
> > > > > SHOULD include
> > > > > >MN-AAA only when it desires to be authenticated/authorized
> > > > > by AAA" is a
> > > > > >good idea.
> > > > > >
> > > > > >Regards,
> > > > > >Kuntal
> > > > > >
> > > > > >
> > > > > >> -----Original Message-----
> > > > > >> From: Charles E. Perkins [mailto:[email-masked]]
> > > > > >> Sent: Monday, January 06, 2003 1:03 PM
> > > > > >> To: Chowdhury, Kuntal [RICH1:2H18:EXCH]; Bharatia, 
> Jayshree 
> > > > > >> [RICH1:2H13:EXCH]; [email-masked]'
> > > > > >> Subject: CLARIFICATION: Re: [mobile-ip]
> > RFC3012bis-04 Available
> > > > > >> 
> > > > > >> 
> > > > > >> "Charles E. Perkins" wrote:
> > > > > >> 
> > > > > >> > >                I don't see the need for MN-FA
> > > authentication
> > > > > >> > > extension when MN-AAA auth extension is present.
> > > > > >> > 
> > > > > >> > The base Mobile IP specification requires it, so
> > it has to be
> > > > > >> > there.
> > > > > >> 
> > > > > >> I meant this in the context of the discussion when
> > the mobile
> > > > > >> node shares a mobility security association with 
> the foreign
> > > > > >> agent.  Of course, the Mobile-Foreign extension is NOT 
> > > required
> > > > > >> when there is no such mobility security association.
> > > > > >> 
> > > > > >> Regards,
> > > > > >> Charlie P.
> > > > > >> 
> > > > > 
> > > > 
> > > 
> > > 
> > 
> 
>

---

From: "Robert J Marks" <[email-masked]>
Date: Mon, 6 Jan 2003 18:55:30 -0600

Kuntal,

> to authenticate the user.

I agree with your last point.

If the WG decides that only one extension should be present, that's OK.
If, however, the WG decides that both may be present, then the
specification
should provide guidance concerning their relative positions.

Bob