Subject: RE: [Mip6] EAP in MIP

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Fri, 4 Mar 2005 00:44:25 -0600

My motivation is to have a network access agnostic AAA-based solution. AAA server deployments are quite common in the enterprise model - at the same time, remote access mobile nodes may be powering up over a varied range of access technologies. It will be nice to have a means of bootstrapping the MN-HA SA without relying on the use of EAP for network access. That way, the MN can still use the same EAP method for MIP6 bootstrapping at all times. 

Vidya

-----Original Message-----
From: Vijay Devarapalli [mailto:[email-masked]] 
Sent: Thursday, March 03, 2005 7:39 PM
To: Narayanan Vidya-CVN065
Cc: 'James Kempf'; [email-masked]
Subject: Re: [Mip6] EAP in MIP

Narayanan Vidya-CVN065 wrote:

> 
> Being an EAP authenticator should not be a huge overhead for the HA - 
> it is a lightweight functionality and it allows HA and MN to have the 
> SA at the end of it.

HA being an EAP authenticator is a non-issue. the real
issue is wether it makes sense carrying EAP using
mobility header messages

Vijay

> 
> Vidya
> 
> 
> -----Original Message-----
> From: James Kempf [mailto:[email-masked]]
> Sent: Thursday, March 03, 2005 5:22 PM
> To: Narayanan Vidya-CVN065; [email-masked]
> Subject: Re: [Mip6] EAP in MIP
> 
> 
> Vidya,
> 
> I think it makes more sense to keep the two functionally separated. It 
> is architecturally cleaner. Thus, one can have multiple kinds of deployment
> models: integrated mobility and access service provider, separated mobility and access service provider; and furthermore can separate out the mobility service authorizer from the mobility service provider. If the signaling is integrated, that's not possible.
> 
> I know 3GPP2 likes having the mobility management signaling and the 
> authentication signaling combined, as is the case for MIP4. Their case 
> is one of always having integrated mobility and access service 
> provider, always having integrated mobility and access service 
> authorizer, and, furthermore, the local and home networks trust each 
> other so much that they allow unsecured authentication material to be 
> transferred between them (from HLR to VLR). I believe we can 
> accommodate their needs using the EAP on network entry protocol 
> defined in draft-giaretta, and, furthermore, the result will be more 
> secure.
> 
>             jak
> 
> 
> 
> ----- Original Message -----
> From: "Narayanan Vidya-CVN065" <[email-masked]>
> To: "'James Kempf'" <[email-masked]>; <[email-masked]>
> Sent: Thursday, March 03, 2005 2:55 PM
> Subject: RE: [Mip6] EAP in MIP
> 
> 
> 
>>James,
>>The point though is that we are using EAP in this case specifically
>>for
> 
> MIP6. If we don't want to run IKEv2 between the MN and HA, this seems 
> like a viable alternative.
> 
>>I do agree that EAP fits more naturally with IKEv2. But, when the
>>usage is
> 
> specifically for setting up the mobility SA, it seems to me that it 
> can be allowed.
> 
>>Vidya
>>
>>-----Original Message-----
>>From: James Kempf [mailto:[email-masked]]
>>Sent: Thursday, March 03, 2005 4:04 PM
>>To: Narayanan Vidya-CVN065; [email-masked]
>>Subject: Re: [Mip6] EAP in MIP
>>
>>
>>Vidya,
>>
>>I believe this was discussed a couple years ago by the WG and
>>explicitly
> 
> rejected.
> 
>>The difference between IKEv2 and MIP6 is that MIP6 is a mobility
> 
> management protocol and IKEv2 is a protocol for performing 
> authentication, authorization, and key exchange. Thus, EAP is a more 
> natural match for IKEv2.
> 
>>            jak
>>
>>
>>----- Original Message -----
>>From: "Narayanan Vidya-CVN065" <[email-masked]>
>>To: <[email-masked]>
>>Sent: Thursday, March 03, 2005 1:03 PM
>>Subject: [Mip6] EAP in MIP
>>
>>
>>
>>>All,
>>>I was wondering if any thought has been given to transporting EAP
>>>within
>>
>>Mobile IP to use EAP-based methods to establish the MN-HA SA. There
>>are
> 
> some drafts on using PANA for MIP6 bootstrapping, which are 
> interesting. Also, the draft on multi-hop EAP 
> (draft-ohba-multihop-eap-00) that attempts at having multiple IP hops 
> between the PaC and the PAA. This is certainly very useful for a 
> variety of applications.
> 
>>>What is really required for MIP to use EAP for dynamically creating
>>>the
>>
>>MN-HA SA is that the HA serve as the EAP authenticator. Of course, the
> 
> other option is where you derive an AMSK in EAP for MIP - but, this 
> only works if the network access uses EAP-based authentication.
> 
>>>Just like IKEv2 supports the transport of EAP within the protocol,
>>>what
>>
>>are the downsides for MIP supporting it? This will only be done at
> 
> bootstrapping time - so, the number of roundtrips taken to complete 
> the SA creation is not a big issue (and it will really depend on the 
> EAP method chosen anyway).
> 
>>>Thanks,
>>>Vidya
>>>
>>
>>
>>----------------------------------------------------------------------
>>----
> 
> --
> 
>>----
>>
>>
>>
>>>_______________________________________________
>>>Mip6 mailing list
>>>[email-masked]
>>>https://www1.ietf.org/mailman/listinfo/mip6
>>>
>>
>>
> 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6