Subject: [mobile-ip] x-HA registration according to draft-ietf-mobileip-vpn-problem-solution-01

From: Alexander Tarnowski <[email-masked]>
Date: Sun, 18 May 2003 23:21:28 +0200 (MEST)

Hello!
I'm sorry to bother all people on this list. Probably this should be
posted somewhere else, but here it comes:
I'm writing an essay about MIP and VPN, which means that I've been
looking quite a lot at draft-ietf-mobileip-vpn-problem-solution-01.
There's one thing I find quite confusing: the outer MIP layer
includes registration with an "external" HA (x-HA), but isn't
authentication between the HA and MN the only mandatory security
mechanism described with a lot of MUSTs in the RFC?
My question is:
* Does the x-HA have some kind of SA with an i-HA? Or
* does the x-HA ignore authentication alltogether? Or
* have I misunderstood everything?
Since the last alternative is the most probable I would be very
grateful for a reference to some document (or section therein) which
clarifies this issue.
/Alexander

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 19 May 2003 08:10:01 +0200

Hej Alexander,

> * Does the x-HA have some kind of SA with an i-HA? Or

No, but (assuming basic MIP functionality) MN and x-HA has a shared secret

> * does the x-HA ignore authentication alltogether?

No, I definitely hope not! :-)

> * have I misunderstood everything?

Not necessarily, but let's check if there's something to straighten out
here.

Let us use the term MIP-SA to signify some kind of security association
between two nodes running MIP, for instance in the form of a shared 
secret. This is in order not to confuse this with IPsec SA's, which are
different creatures.

Then in the case of running both an internal and external HA, with a
VPN box in between, the MN would need to have both a MIP-SA with x-HA,
an SA with the VPN box, and a MIP-SA with the i-HA in order to successfully
register at home.

Does this answer your question, or have I misunderstood everything? ,:-)

	Regards,
		Henrik

---

From: Alexander Tarnowski <[email-masked]>
Date: Mon, 19 May 2003 11:00:51 +0200 (MEST)

Hello again,
I did use the term SA in a confusing way. I meant shared secret, of
course. Nevertheless I still don't understand. The way I figured
x-HAs are deployed in visited networks by other companies than the
one owning the private network as a service to potential roaming
visitors.
The point is that the mobile node just arrives at a new network
knowing nothing about its x-HA (not knowing the shared secret).
If my basic assupmtion about x-HAs being owned by unknown entities is
wrong, then the question needs no further answers. But, on the other
hand, if x-HAs are owned by different companies we have the issue of
SLAs, paper work, key distribution etc.
/Alexander

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 19 May 2003 11:32:09 +0200

On Mon, 19 May 2003 11:00:51 +0200 (MEST)

> SLAs, paper work, key distribution etc.

Ah, thereä we have the discrepancy. The x-HA would be deployed right
outside the VPN box, as part of the home network setup, not by the
visited network or any intermediary. So we need to make this point
clearer in the draft, I guess.

	Thanks!

		Henrik

	Henrik

-- 
  To stay young requires unceasing cultivation of the ability to unlearn
  old falsehoods.