Subject: RE: [Mip6] EAP in MIP

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Thu, 3 Mar 2005 16:55:30 -0600

James,
The point though is that we are using EAP in this case specifically for MIP6. If we don't want to run IKEv2 between the MN and HA, this seems like a viable alternative. 

I do agree that EAP fits more naturally with IKEv2. But, when the usage is specifically for setting up the mobility SA, it seems to me that it can be allowed. 

Vidya

-----Original Message-----
From: James Kempf [mailto:[email-masked]] 
Sent: Thursday, March 03, 2005 4:04 PM
To: Narayanan Vidya-CVN065; [email-masked]
Subject: Re: [Mip6] EAP in MIP

Vidya,

I believe this was discussed a couple years ago by the WG and explicitly rejected.

The difference between IKEv2 and MIP6 is that MIP6 is a mobility management protocol and IKEv2 is a protocol for performing authentication, authorization, and key exchange. Thus, EAP is a more natural match for IKEv2.

            jak

----- Original Message ----- 
From: "Narayanan Vidya-CVN065" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, March 03, 2005 1:03 PM
Subject: [Mip6] EAP in MIP

> All,
> I was wondering if any thought has been given to transporting EAP 
> within
Mobile IP to use EAP-based methods to establish the MN-HA SA. There are some drafts on using PANA for MIP6 bootstrapping, which are interesting. Also, the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that attempts at having multiple IP hops between the PaC and the PAA. This is certainly very useful for a variety of applications.
>
> What is really required for MIP to use EAP for dynamically creating 
> the
MN-HA SA is that the HA serve as the EAP authenticator. Of course, the other option is where you derive an AMSK in EAP for MIP - but, this only works if the network access uses EAP-based authentication.
>
> Just like IKEv2 supports the transport of EAP within the protocol, 
> what
are the downsides for MIP supporting it? This will only be done at bootstrapping time - so, the number of roundtrips taken to complete the SA creation is not a big issue (and it will really depend on the EAP method chosen anyway).
> Thanks,
> Vidya

----------------------------------------------------------------------------
----

> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
>

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "James Kempf" <[email-masked]>
Date: Thu, 3 Mar 2005 15:22:07 -0800

Vidya,

I think it makes more sense to keep the two functionally separated. It is
architecturally cleaner. Thus, one can have multiple kinds of deployment
models: integrated mobility and access service provider, separated mobility
and access service provider; and furthermore can separate out the mobility
service authorizer from the mobility service provider. If the signaling is
integrated, that's not possible.

I know 3GPP2 likes having the mobility management signaling and the
authentication signaling combined, as is the case for MIP4. Their case is
one of always having integrated mobility and access service provider, always
having integrated mobility and access service authorizer, and, furthermore,
the local and home networks trust each other so much that they allow
unsecured authentication material to be transferred between them (from HLR
to VLR). I believe we can accommodate their needs using the EAP on network
entry protocol defined in draft-giaretta, and, furthermore, the result will
be more secure.

            jak

----- Original Message ----- 
From: "Narayanan Vidya-CVN065" <[email-masked]>
To: "'James Kempf'" <[email-masked]>; <[email-masked]>
Sent: Thursday, March 03, 2005 2:55 PM
Subject: RE: [Mip6] EAP in MIP

> James,
> The point though is that we are using EAP in this case specifically for
MIP6. If we don't want to run IKEv2 between the MN and HA, this seems like a
viable alternative.
>
> I do agree that EAP fits more naturally with IKEv2. But, when the usage is
specifically for setting up the mobility SA, it seems to me that it can be
allowed.
> The difference between IKEv2 and MIP6 is that MIP6 is a mobility
management protocol and IKEv2 is a protocol for performing authentication,
authorization, and key exchange. Thus, EAP is a more natural match for
IKEv2.
> Mobile IP to use EAP-based methods to establish the MN-HA SA. There are
some drafts on using PANA for MIP6 bootstrapping, which are interesting.
Also, the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that attempts
at having multiple IP hops between the PaC and the PAA. This is certainly
very useful for a variety of applications.
> MN-HA SA is that the HA serve as the EAP authenticator. Of course, the
other option is where you derive an AMSK in EAP for MIP - but, this only
works if the network access uses EAP-based authentication.
> are the downsides for MIP supporting it? This will only be done at
bootstrapping time - so, the number of roundtrips taken to complete the SA
creation is not a big issue (and it will really depend on the EAP method
chosen anyway).