Subject: [Mip6] Comments on jee-mip6-bootstrap-pana

From: Alper Yegin <[email-masked]>
Date: Mon, 01 Nov 2004 17:22:41 -0800

Hello,

Here are some comments and questions on the
draft-jee-mip6-bootstrap-pana-00.txt.

- I see the new Diameter application has two functionalities. Regarding
the delivery of the bootstrapping information to the MN, I was wondering
if we could get away with not defining new commands, but instead
piggybacking on existing NAS application? The bootstrapping information
could be delivered to the NAS as part of the mobile's profile.

- The other functionality is the push of bootstrapping information from
AAAh to HA. This is carried in serial with the (in fact, in the middle
of) network access AAA. I think it could be done in parallel, or even
after the network access AAA. If you use a pull model instead of the
push, this part gets aligned with the yegin-mip6-aaa-fwk.

- I didn't quite understand how the MN obtains/computes the
MIPv6-AAA-Key. It is only provided with the MIPv6-AAA-Key-Id, and that's
not sufficient to derive the key.

Thanks in advance.

Alper

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Junghoon Jee" <[email-masked]>
Date: Wed, 3 Nov 2004 10:18:03 +0900

Hello Alper, 
Thank you very much for reading the I-D and the feedback.

> could be delivered to the NAS as part of the mobile's profile.

The mobile node's bootstrapping information may be piggybacked to the
previous NAS application. In that case, we still should define new commands 
between AAA server and HA. Moreover, I think we should support 
the Mobile IPv6 bootstrapping in the visited domain.
It means that mobile nodes' home address and HA is assigned in the visited domain.
Simply piggybacking to the existing the NAS application can not be a solution in this case.
The bootstrapping support in the visited domain is described in the section 4.3.2 of draft-jee-mip6-bootstrap-pana-00.txt.
I think defining a new application with new command codes and AVPs is the right choice.

> push, this part gets aligned with the yegin-mip6-aaa-fwk.

Right, I agree with you.
One question, If we use a pull model, does HA request the bootstrapping information to the AAA server ?

> not sufficient to derive the key.

PANA-AAA-Key-Id is used to identify the PANA-AAA-Key as specified in the draft-ietf-pana-pana-06.txt.
Similarly, MIPv6-AAA-Key-Id is used to identify the MIPv6-AAA-Key given the PANA and AAA session.
Any missing point ?
MN computes the IKE PSK using the MIPv6-AAA-Key as specified in the section 4.9 of draft-jee-mip6-bootstrap-pana-00.txt.

Best Regards,

Junghoon

---

From: Alper Yegin <[email-masked]>
Date: Tue, 02 Nov 2004 19:03:40 -0800

Hi Junghoon,

> One question, If we use a pull model, does HA request the
bootstrapping
> information to the AAA server ?

Yes.

> PANA-AAA-Key-Id is used to identify the PANA-AAA-Key as specified in
the
> draft-ietf-pana-pana-06.txt.
> Similarly, MIPv6-AAA-Key-Id is used to identify the MIPv6-AAA-Key
given
> the PANA and AAA session.
> Any missing point ?

Keys are independent of the Key-Ids. Unless you know the Key, you cannot
compute it from the Key-Id. 

> MN computes the IKE PSK using the MIPv6-AAA-Key as specified in the
> section 4.9 of draft-jee-mip6-bootstrap-pana-00.txt.

Alper

---

From: "Junghoon Jee" <[email-masked]>
Date: Wed, 3 Nov 2004 13:43:01 +0900

Hi Alper,

> > information to the AAA server ?

If the HA should request to the AAA server to get a bootstrapping information, I think
the HA should know the time when AAA server completes the configuration of bootstrapping information.
How can the HA identify that the bootstrapping information configuration is completed in the AAA server ?

Junghoon

---

From: Alper Yegin <[email-masked]>
Date: Tue, 02 Nov 2004 21:40:24 -0800

Junghoon,

>  > > > - The other functionality is the push of bootstrapping
information
> > from
> the HA should know the time when AAA server completes the
configuration of
> bootstrapping information.
> How can the HA identify that the bootstrapping information
configuration
> is completed in the AAA server ?

HA can contact the AAA server when the MN starts the IKE exchange.

Alper

---

From: "Junghoon Jee" <[email-masked]>
Date: Wed, 3 Nov 2004 16:37:57 +0900

Alper, 
 
> HA can contact the AAA server when the MN starts the IKE exchange.

You mean that the HA requests the bootstrapping information to the AAA server 
after the HA receives the IKE initiation message from the MN ?
If so, isn't there any open issues about initiating IKE exchange between the MN and HA
before the HA gets bootstrapping information ?

Junghoon

---

From: "Junghoon Jee" <[email-masked]>
Date: Wed, 3 Nov 2004 16:49:25 +0900

Alper,

> > section 4.9 of draft-jee-mip6-bootstrap-pana-00.txt.

The AAA server and the MN maintains the key mapping table, MIPv6-AAA-Key-Id vs. MIPv6-AAA-Key.
When EAP authentication is succeeded, the MIPv6-AAA-Key and its id. are stored to the key mapping table.
The MIPv6-AAA-Key can be an AAA-Key or concatenation of the AAA-Key' with AAA-Key'' if multiple
session keys are derived by the EAP authentication process. The choice of which key to use to derive MIPv6 IKE PSK is
determined by the AAA home server. The AAA home server notifies the MN which key to use by sending the MIPv6-AAA-Key-Id.

Junghoon

---

From: Alper Yegin <[email-masked]>
Date: Wed, 03 Nov 2004 15:13:18 -0800

JungHoon,

> If so, isn't there any open issues about initiating IKE exchange
between
> the MN and HA

The flow in my mind is this:

1. MN engages in network access AAA. That sets up state on AAAh.
2. MN starts IKE with the HA. That triggers the HA contact with AAAh.

So, it is the IKE exchange that prompts the HA to contact the AAAh. 

Alper