Subject: RE: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt

From: "Kent Leung \(kleung\)" <[email-masked]>
Date: Thu, 1 Dec 2005 15:04:04 -0800

I vote for #2.  The reason is that that RFC 3012 is addressing two
functions, as stated in previous emails (initiated by Gabe's review and
comment to split this draft).

1) FA challenge/authentication and MN-FA replay protection.  

2) Generalized authentication (e.g. MN-AAA), which is independent if the
NAS is FA or HA.

I would like to keep this in one draft, which means both functions
should be covered fully (i.e. including CCoA mode).  I believe that
Vijay was OK with this except he wanted to explicitly state that replay
protection is using nonce/timestamp.  But I don't see a need since this
is fundamental function of Mobile IP itself.

Kent

> -----Original Message-----
> From: Jayshree Bharatia [mailto:[email-masked]] 
> Sent: Thursday, December 01, 2005 2:46 PM
> To: Charles E. Perkins; Kent Leung (kleung); 
> [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked]; 
> [email-masked]
> Subject: RE: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt
> 
> Hi all,
> 
> I am not sure how to proceed toward supporting co-located CoA 
> mode in RFC3012bis. RFC3012 doesn't have any details on this 
> and it was a working assumption that this draft is not 
> applicable for co-located CoA mode.
> 
> Later in the process of updating RFC3012bis, there was a 
> discussion that we shouldn't be limiting use of MN-AAA 
> extension for co-located CoA mode. Anyway, we need to come up 
> with some agreement now. The following is the summary of the 
> discussion:
> - Kent and Madjid think that having clarification that there 
> is no challenge included in the MN-AAA extension for 
> co-located CoA mode is good. Although, there is no need of 
> indicating what type of value is used for replay protection. 
> Although, Vijay likes to see this to be clarified.
> - Charlie suggest removing support of co-located CoA mode.
> 
> Hence, I have three options:
> 1. Remove the paragraph which discusses co-located CoA 
> support (last paragraph of section 3.1) 2. Make changes to 
> indicate that there is no challenge included in the MN-CoA 
> extension for co-located CoA mode.
> 3. Include changes proposed by Vijay in earlier email.
> 
> Please send me reply suggesting which option you prefer.
> 
> Regards,
> Jayshree
> 
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Charles E. Perkins
> Sent: Wednesday, November 30, 2005 7:05 PM
> To: Kent Leung (kleung)
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt
> 
> 
> 
> Hello folks,
> 
> I do not believe the document should support co-located CoA 
> mode.  The point is to enable some mechanism for use by the 
> foreign agent.  There is no need for a mobile node to use the 
> challenge.  No additional replay protection is afforded.
> 
> I would prefer for the use of the extension to be prohibited 
> whenever the 'D' bit is set.
> 
> Even when a foreign agent is sending 'R' bit advertisements, 
> there isn't any significant functionality gained.
> 
> Perhaps it's technically feasible to have the challenge in 
> such situations, but (i) it is wasteful and (ii) I would not 
> like to see it become considered a mandatory part of any 
> mobile node implementation where co-located care-of addresses 
> are used, for whatever reason.
> 
> Regards,
> Charlie P.
> 
> PS. Please excuse if I have overlooked some e-mail about this.
> 
> 
> Kent Leung (kleung) wrote:
> 
> >On this particular topic, I don't understand what is missing in the 
> >details to support the CCoA mode?  Since the draft covers MN-AAA 
> >authentication with NAS in between, I would like to see both 
> FA (CoA) 
> >and HA (CCoA) modes supported.  Where else would we be able to cover 
> >just the CCoA for MN-AAA authentication if not in this draft?
> >
> >Kent
> >
> >
> >  
> >
> >>not at this late stage. its fine as it is. however, I have 
> one comment 
> >>on the support for co-located CoA mode. the draft claims it 
> supports 
> >>it but there really isnt enough detail.
> >>IMO, it should be clarified that only FA mode is described in the 
> >>draft.
> >>
> >>    
> >>
> >
> >  
> >
> 
> 
> 
> --
> Mip4 mailing list: [email-masked]
>     Web interface: https://www1.ietf.org/mailman/listinfo/mip4
>      Charter page: http://www.ietf.org/html.charters/mip4-charter.html
> Supplemental site: http://www.mip4.org/
> 

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 01 Dec 2005 17:54:38 -0800

Hello Kent,

What if the draft allows the Generalized Authentication
extension for mobile nodes with CCoA, but does not allow
the challenge extension?  I don't see what's wrong with this,
since the draft is "about" a foreign agent protocol.

Then, enabling the Generalized Authentication extension
for co-located CoA just amounts to reasonable practice,
not refocussing the document on colocated CoA.

Regards,
Charlie P.

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 01 Dec 2005 15:41:55 -0800

Kent Leung (kleung) wrote:
> should be covered fully (i.e. including CCoA mode). 

okay until this far.

> I believe that

it is needed because 3012 leaves things incomplete without
this. if you notice in my changes I did reference RFC 3344
when I spoke about replay protection in the co-located CoA
mode. I didnt propose a new mechanism.

Vijay

---

From: Pete McCann <[email-masked]>
Date: Fri, 2 Dec 2005 10:01:47 -0600

Chair hat off, I think there is clearly value in using MN-AAA
authenticator even in co-located mode, especially if one is trying to
bootstrap an HA for which no security association exists yet.  I
support Kent's and Vijay's suggested changes.

-Pete