Subject: [Mip6] EAP in MIP

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Thu, 3 Mar 2005 15:03:37 -0600

All,
I was wondering if any thought has been given to transporting EAP within Mobile IP to use EAP-based methods to establish the MN-HA SA. There are some drafts on using PANA for MIP6 bootstrapping, which are interesting. Also, the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that attempts at having multiple IP hops between the PaC and the PAA. This is certainly very useful for a variety of applications. 
 
What is really required for MIP to use EAP for dynamically creating the MN-HA SA is that the HA serve as the EAP authenticator. Of course, the other option is where you derive an AMSK in EAP for MIP - but, this only works if the network access uses EAP-based authentication. 
 
Just like IKEv2 supports the transport of EAP within the protocol, what are the downsides for MIP supporting it? This will only be done at bootstrapping time - so, the number of roundtrips taken to complete the SA creation is not a big issue (and it will really depend on the EAP method chosen anyway). 
 
Thanks,
Vidya
_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 03 Mar 2005 14:00:34 -0800

just to make sure I understand. are you proposing carrying
EAP messages in new mobility header messages?

currently, you can run IKEv2 between the MN and the HA and
use EAP.

Vijay

Narayanan Vidya-CVN065 wrote:
> All,
> I was wondering if any thought has been given to transporting EAP within 
> Mobile IP to use EAP-based methods to establish the MN-HA SA. There are 
> some drafts on using PANA for MIP6 bootstrapping, which are interesting. 
> Also, the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that 
> attempts at having multiple IP hops between the PaC and the PAA. This is 
> certainly very useful for a variety of applications.
>  
> What is really required for MIP to use EAP for dynamically creating the 
> MN-HA SA is that the HA serve as the EAP authenticator. Of course, the
> other option is where you derive an AMSK in EAP for MIP - but, this only 
> works if the network access uses EAP-based authentication.
>  
> Just like IKEv2 supports the transport of EAP within the protocol, what 
> are the downsides for MIP supporting it? This will only be done at 
> bootstrapping time - so, the number of roundtrips taken to complete the 
> SA creation is not a big issue (and it will really depend on the EAP 
> method chosen anyway).
>  
> Thanks,
> Vidya
> 
> 
> ------------------------------------------------------------------------
>

---

From: "James Kempf" <[email-masked]>
Date: Thu, 3 Mar 2005 14:03:37 -0800

Vidya,

I believe this was discussed a couple years ago by the WG and explicitly
rejected.

The difference between IKEv2 and MIP6 is that MIP6 is a mobility management
protocol and IKEv2 is a protocol for performing authentication,
authorization, and key exchange. Thus, EAP is a more natural match for
IKEv2.

            jak

----- Original Message ----- 
From: "Narayanan Vidya-CVN065" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, March 03, 2005 1:03 PM
Subject: [Mip6] EAP in MIP

> I was wondering if any thought has been given to transporting EAP within
Mobile IP to use EAP-based methods to establish the MN-HA SA. There are some
drafts on using PANA for MIP6 bootstrapping, which are interesting. Also,
the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that attempts at
having multiple IP hops between the PaC and the PAA. This is certainly very
useful for a variety of applications.
> What is really required for MIP to use EAP for dynamically creating the
MN-HA SA is that the HA serve as the EAP authenticator. Of course, the other
option is where you derive an AMSK in EAP for MIP - but, this only works if
the network access uses EAP-based authentication.
are the downsides for MIP supporting it? This will only be done at
bootstrapping time - so, the number of roundtrips taken to complete the SA
creation is not a big issue (and it will really depend on the EAP method
chosen anyway).
> Vidya

----------------------------------------------------------------------------
----