Subject: [Mip6] Concerning mip6 auth. and conf. based on EAP

From: Julien Bournelle <[email-masked]>
Date: Thu, 12 Feb 2004 11:22:48 +0100

Hi,

 I had a quick reading of your draft and I have a few comments/questions.

-1- Maybe it would be better to present the PEAPv2 case in appendix and
to have a general approach in the rest of the draft.

-2- You define a new application for Diameter. I think you need to
define a stand-alone internet-draft for this. You can't define two
protocols in one draft, can you ? May I suggest you split your draft
into two parts ?

-3- In your abstract, you wrote:
"
The same approach can be ported also to environments performing user 
authentication with methods other than EAP (e.g. GSM, UMTS or CDMA), 
by simply using PANA with null authentication to undertake MIPv6 
negotiation after the user has gained IP access to the network. 
"

I don't clearly understand what you mean: what would be the pros for the
use of PANA in such a context ? 

-- 
[email-masked]

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Giaretta Gerardo <[email-masked]>
Date: Thu, 12 Feb 2004 11:47:42 +0100

Hi Julien,

Thanks for your comments and feedback. See inline...

> to have a general approach in the rest of the draft.

In this first version, we decided to describe a complete example of the procedure, describing it using PEAPv2. Surely presenting the PEAPv2 case in an appendix and describing the general case in the rest of the draft may be a good idea. 

> protocols in one draft, can you ? May I suggest you split your draft

We thought about it, but, as I said before, we have decided to describe the complete procedure in this first version of the draft. However, I agree with you that maybe the draft should be split in two separate docs, one for EAP communication and the other for the new Diameter Application.

> use of PANA in such a context ? 

Maybe other procedures could be more efficient. The main advantage of our procedure lies in the possibility of re-using those messages and TLVs defined in the WLAN case even when the MN accesses a cellular network: this could be a great advantage in a heterogeneous scenario. Therefore, in this way the MN can use the same approach and the same procedures to perform MIPv6 configuration regardless of the access network (e.g. WLAN or GPRS).

--Gerardo

> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
> 

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please contact us by
replying to [email-masked]. Thank you
====================================================================

---

From: Mayumi Yanagiya <[email-masked]>
Date: Fri, 13 Feb 2004 20:42:46 +0900

Hi Gerardo,

I’m interested in your draft.
I have some comments and questions.

- It is specified that AAAH send cryptographic material to MN.
  I think it is not necessary, when Pre-shared Key based authentication
  is applied to establish ISAKMP SA.
  Because AAA and MN can share symmetric key, EAP Key, during access
  authentication. And AAA and MN also can derive symmetric key from
  the shared key.
  It is specified in "draft-salowey-eap-key-deriv-02.txt".
  We proposed an architecture which use EAP key as service
  authentication.<draft-yanagiya-eap-saa-00.txt>
  And we are going to submit revised draft which includes a method
  that applied the above concept to establish SA between HA and MN.

- You used “AAA” and “AAAH” as authentication server.
  Is it a spelling mistake or not?

- In actual public service network, I think it is difficult that
  AAAH selects proper HA in visited network.  So, I think
   -AAAH authenticates MN, and
   -AAA in visited network selects proper HA and distributes
    cryptographic material
  Would you mind giving comments to this idea?

Sincerely yours

Mayumi,

>Hi,
>
>we submitted a new I-D, draft-giaretta-mip6-authorization-eap-00.txt.
>It defines a method for performing dynamic Mobile IPv6 authorization
>and configuration relaying on a AAA infrastructure: the necessary
>interaction between the AAA server of the home provider and the mobile
>node is realized using EAP, exploiting the capability of some EAP
>methods (e.g. PEAPv2) to convey generic information items together with
>authentication data.
>
>The Internet-Draft is available from the on-line Internet-Drafts
>directories. The URL is:
>http://www.ietf.org/internet-drafts/draft-giaretta-mip6-authorization-eap-00.txt
>
>Any comments are welcome.
>
>Best Regards,
>
>--Gerardo Giaretta
-- 

*++++++++++++++++++++++++++++++++++++++++++
NTT Network Service Systems Laboratories
Mayumi Yanagiya
tel: +81 422 59 6783   fax: +81 422 37 7688
E-mail: [email-masked]
+++++++++++++++++++++++++++++++++++++++++++*