Subject: RE: [Mip6] EAP in MIP

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Thu, 3 Mar 2005 17:43:51 -0600

James,
I am actually not proposing an alternative to draft-giaretta. I am just wondering if mip6 optionally allowed EAP to be carried, it will help in cases where the mobile node is powering up on an access network that does not use EAP for authentication. 

I am concerned that by only defining the derivation of the MSA via the network access EAP procedure, the applicability of EAP for this is limited to those mobile nodes that bootstrap on a network supporting EAP. By optionally also providing a provision in mip6, the MN can decide based on what it does for network access whether or not to include it in the MIP6 message. 

This still preserves the 3-party authentication model. In my mind, the mobility service authorizer in this case is really the AAA server - so, this is still separate from the mobility serivce provider, no? It is only a question of which entity does the function of an EAP authenticator - I'm suggesting that the HA must be able to provide this function for those mobile nodes that need it. 

Being an EAP authenticator should not be a huge overhead for the HA - it is a lightweight functionality and it allows HA and MN to have the SA at the end of it. 

Vidya

-----Original Message-----
From: James Kempf [mailto:[email-masked]] 
Sent: Thursday, March 03, 2005 5:22 PM
To: Narayanan Vidya-CVN065; [email-masked]
Subject: Re: [Mip6] EAP in MIP

Vidya,

I think it makes more sense to keep the two functionally separated. It is architecturally cleaner. Thus, one can have multiple kinds of deployment
models: integrated mobility and access service provider, separated mobility and access service provider; and furthermore can separate out the mobility service authorizer from the mobility service provider. If the signaling is integrated, that's not possible.

I know 3GPP2 likes having the mobility management signaling and the authentication signaling combined, as is the case for MIP4. Their case is one of always having integrated mobility and access service provider, always having integrated mobility and access service authorizer, and, furthermore, the local and home networks trust each other so much that they allow unsecured authentication material to be transferred between them (from HLR to VLR). I believe we can accommodate their needs using the EAP on network entry protocol defined in draft-giaretta, and, furthermore, the result will be more secure.

            jak

----- Original Message ----- 
From: "Narayanan Vidya-CVN065" <[email-masked]>
To: "'James Kempf'" <[email-masked]>; <[email-masked]>
Sent: Thursday, March 03, 2005 2:55 PM
Subject: RE: [Mip6] EAP in MIP

> James,
> The point though is that we are using EAP in this case specifically 
> for
MIP6. If we don't want to run IKEv2 between the MN and HA, this seems like a viable alternative.
>
> I do agree that EAP fits more naturally with IKEv2. But, when the 
> usage is
specifically for setting up the mobility SA, it seems to me that it can be allowed.
>
> Vidya
>
> -----Original Message-----
> From: James Kempf [mailto:[email-masked]]
> Sent: Thursday, March 03, 2005 4:04 PM
> To: Narayanan Vidya-CVN065; [email-masked]
> Subject: Re: [Mip6] EAP in MIP
>
>
> Vidya,
>
> I believe this was discussed a couple years ago by the WG and 
> explicitly
rejected.
>
> The difference between IKEv2 and MIP6 is that MIP6 is a mobility
management protocol and IKEv2 is a protocol for performing authentication, authorization, and key exchange. Thus, EAP is a more natural match for IKEv2.
>
>             jak
>
>
> ----- Original Message -----
> From: "Narayanan Vidya-CVN065" <[email-masked]>
> To: <[email-masked]>
> Sent: Thursday, March 03, 2005 1:03 PM
> Subject: [Mip6] EAP in MIP
>
>
> > All,
> > I was wondering if any thought has been given to transporting EAP 
> > within
> Mobile IP to use EAP-based methods to establish the MN-HA SA. There 
> are
some drafts on using PANA for MIP6 bootstrapping, which are interesting. Also, the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that attempts at having multiple IP hops between the PaC and the PAA. This is certainly very useful for a variety of applications.
> >
> > What is really required for MIP to use EAP for dynamically creating 
> > the
> MN-HA SA is that the HA serve as the EAP authenticator. Of course, the
other option is where you derive an AMSK in EAP for MIP - but, this only works if the network access uses EAP-based authentication.
> >
> > Just like IKEv2 supports the transport of EAP within the protocol, 
> > what
> are the downsides for MIP supporting it? This will only be done at
bootstrapping time - so, the number of roundtrips taken to complete the SA creation is not a big issue (and it will really depend on the EAP method chosen anyway).
> >
> > Thanks,
> > Vidya
> >
>
>
> ----------------------------------------------------------------------
> ----
--
> ----
>
>
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
> >
>
>

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 03 Mar 2005 17:31:06 -0500

EAP requires a transport that provides orderly delivery.  Both PANA
and IKEv2 satisfy the EAP transport requirement (PANA and IKEv2
actually provide not only orderly delivery, but also reliable
transport of EAP messages).  I don't think it is easy to change Mobile
IPv6 signaling to satisfy the EAP transport requirement.

Yoshihiro Ohba

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 03 Mar 2005 17:39:18 -0800

> Being an EAP authenticator should not be a huge overhead for the HA - it is a lightweight functionality and it allows HA and MN to have the SA at the end of it. 

HA being an EAP authenticator is a non-issue. the real
issue is wether it makes sense carrying EAP using
mobility header messages

Vijay

---

From: "James Kempf" <[email-masked]>
Date: Fri, 4 Mar 2005 09:02:33 -0800

Precisely.

Additionally, even if it did, there still would need to be some way to
bootstrap the HA address and home address. It's not even possible to send a
mobility header to the HA if the HA's address is unknown. The
EAP-on-network-entry technique provides that.

            jak

----- Original Message ----- 
From: "Vijay Devarapalli" <[email-masked]>
To: "Narayanan Vidya-CVN065" <[email-masked]>
Cc: "'James Kempf'" <[email-masked]>; <[email-masked]>
Sent: Thursday, March 03, 2005 5:39 PM
Subject: Re: [Mip6] EAP in MIP

> > Being an EAP authenticator should not be a huge overhead for the HA - it
is a lightweight functionality and it allows HA and MN to have the SA at the
end of it.
> > I think it makes more sense to keep the two functionally separated. It
is architecturally cleaner. Thus, one can have multiple kinds of deployment
> > models: integrated mobility and access service provider, separated
mobility and access service provider; and furthermore can separate out the
mobility service authorizer from the mobility service provider. If the
signaling is integrated, that's not possible.
> >
> > I know 3GPP2 likes having the mobility management signaling and the
authentication signaling combined, as is the case for MIP4. Their case is
one of always having integrated mobility and access service provider, always
having integrated mobility and access service authorizer, and, furthermore,
the local and home networks trust each other so much that they allow
unsecured authentication material to be transferred between them (from HLR
to VLR). I believe we can accommodate their needs using the EAP on network
entry protocol defined in draft-giaretta, and, furthermore, the result will
be more secure.
> > management protocol and IKEv2 is a protocol for performing
authentication, authorization, and key exchange. Thus, EAP is a more natural
match for IKEv2.
> > some drafts on using PANA for MIP6 bootstrapping, which are interesting.
Also, the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that attempts
at having multiple IP hops between the PaC and the PAA. This is certainly
very useful for a variety of applications.
> > other option is where you derive an AMSK in EAP for MIP - but, this only
works if the network access uses EAP-based authentication.
> > bootstrapping time - so, the number of roundtrips taken to complete the
SA creation is not a big issue (and it will really depend on the EAP method
chosen anyway).