Subject: [Mip6] Comments on ohba-mip6-boot-arch-dhcp

From: Alper Yegin <[email-masked]>
Date: Mon, 01 Nov 2004 16:28:09 -0800

Hello,

I just read draft-ohba-mip6-boot-arch-dhcp-00.txt. Please see below for
my comments and questions.

- Is authenticated DHCP a necessary component of this solution, or
another problem (bootstrapping RFC3118) solved by the overall solution?
If it is the latter, separating the problems/solutions would simplify
the reading, imo.

- As I understand the functionality of AAA-MS is to bring in the HA/HoA
information to the access network. What would be the drawback of
performing that functionality via AAA-NA? I know this is mentioned once
in the document, but can't we always do that?

- The document is referring to an interface between the AAA-MS and HA:

	 When the home agent receives an authentication request message
       (e.g., an IKE_SA_INIT request message in IKEv2) from the mobile
       node, it requests IKE credentials such as a symmetric key to the
       AAA server.  Alternatively, the AAA server may send the IKE
       credentials to the home agent before the home agent receives the
       authentication request message.

yegin-mip6-aaa-fwk aims at such an interface (though, only the "pull"
variant). I was wondering what the authors were thinking for handling
that interface. This has a different functionality than the AAA-MS
protocol defined in this document.

Thanks in advance.

Alper

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 01 Nov 2004 17:38:54 -0500

Hi Alper,

Thank you for reading the draft and sending the comments.
Please see my comments below.

> If it is the latter, separating the problems/solutions would simplify

I think we could separate authenticated DHCP from this solution.
Thank you very much for your insight.

> in the document, but can't we always do that?

In some case, the home address may be updated to another one during
the mobile node's authorization lifetime for network access.  In such
a case, it might be good if AAA-MS is not always performed via AAA-NA.
If there is some need on such a scenario we would think more about it
in the next revision.

> protocol defined in this document.

Good point.  I agree with you that there is some difference between
draft-ohba-mip6-boot-arch-dhcp and draft-yegin-mip6-aaa-fwk in the
interface between HA and AAA-MS server.  As far as I understand, the
difference is as to when authentication to derive the IKE credentials
occurs.  In draft-yegin-mip6-aaa-fw, authentication to derive the IKE
credentials occurs during AAA-MS procedure.  In
draft-ohba-mip6-boot-arch-dhcp, authentication to derive the IKE
credentials occurs during AAA-NA procedure.

> Thanks in advance.

Thank you,

Yoshihiro Ohba