Subject: RE: [Mip6] EAP in MIP

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Fri, 4 Mar 2005 10:58:44 -0600

Hi Gerardo,
As you say, bootstrapping an IPSec SA is not a problem - IKEv2 is sufficient there. For the AUTH option, using PANA and multi-hop EAP would work - if you are already using PANA for sake of some network access, that is good. But, if you are imposing PANA just for sake of MIP6 bootstrapping, that is where I have a concern doing that. Typically, I think of PANA being used for network access when there is no lower layer protocol that carries EAP. For mobile nodes that don't have that need and still want to use EAP for MIP6, they now need to support PANA. 

We can perhaps talk more on the topic next week at IETF. 

Thanks,
Vidya

-----Original Message-----
From: Gerardo Giaretta [mailto:[email-masked]] 
Sent: Friday, March 04, 2005 3:24 AM
To: Narayanan Vidya-CVN065
Cc: [email-masked]; James Kempf; Vijay Devarapalli
Subject: RE: [Mip6] EAP in MIP

Hi Vidya,

see below..

> 
> My motivation is to have a network access agnostic AAA-based
> solution. AAA server deployments are quite common in the 
> enterprise model - at the same time, remote access mobile 
> nodes may be powering up over a varied range of access 
> technologies. It will be nice to have a means of 
> bootstrapping the MN-HA SA without relying on the use of EAP 
> for network access. That way, the MN can still use the same 
> EAP method for MIP6 bootstrapping at all times. 
> 

This could be interesting. However, you don't need to carry EAP messages
using mobility header messages, that is not architecturally clean IMO: 
- if you want to bootstrap an IPsec SA, you can use IKEv2.
- if you want to bootstrap a SA for the AUTH protocol, you can rely on
some PANA extensions (see draft-tschofenig-mip6-bootstrapping-pana-00)
or on a multi-hop EAP lower layer (see draft-ohba-multihop-eap-00,
sections 2.3 and 2.4: a Bar BoF is scheduled on March 8th, 8pm).

--Gerardo

> Vidya
> 
> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]] 
> Sent: Thursday, March 03, 2005 7:39 PM
> To: Narayanan Vidya-CVN065
> Cc: 'James Kempf'; [email-masked]
> Subject: Re: [Mip6] EAP in MIP
> 
> 
> Narayanan Vidya-CVN065 wrote:
> 
> > 
> > Being an EAP authenticator should not be a huge overhead 
> for the HA - 
> > it is a lightweight functionality and it allows HA and MN 
> to have the 
> > SA at the end of it.
> 
> HA being an EAP authenticator is a non-issue. the real
> issue is wether it makes sense carrying EAP using
> mobility header messages
> 
> Vijay
> 
> > 
> > Vidya
> > 
> > 
> > -----Original Message-----
> > From: James Kempf [mailto:[email-masked]]
> > Sent: Thursday, March 03, 2005 5:22 PM
> > To: Narayanan Vidya-CVN065; [email-masked]
> > Subject: Re: [Mip6] EAP in MIP
> > 
> > 
> > Vidya,
> > 
> > I think it makes more sense to keep the two functionally 
> separated. It 
> > is architecturally cleaner. Thus, one can have multiple 
> kinds of deployment
> > models: integrated mobility and access service provider, 
> separated mobility and access service provider; and 
> furthermore can separate out the mobility service authorizer 
> from the mobility service provider. If the signaling is 
> integrated, that's not possible.
> > 
> > I know 3GPP2 likes having the mobility management signaling and the 
> > authentication signaling combined, as is the case for MIP4. 
> Their case 
> > is one of always having integrated mobility and access service 
> > provider, always having integrated mobility and access service 
> > authorizer, and, furthermore, the local and home networks 
> trust each 
> > other so much that they allow unsecured authentication 
> material to be 
> > transferred between them (from HLR to VLR). I believe we can 
> > accommodate their needs using the EAP on network entry protocol 
> > defined in draft-giaretta, and, furthermore, the result 
> will be more 
> > secure.
> > 
> >             jak
> > 
> > 
> > 
> > ----- Original Message -----
> > From: "Narayanan Vidya-CVN065" <[email-masked]>
> > To: "'James Kempf'" <[email-masked]>; <[email-masked]>
> > Sent: Thursday, March 03, 2005 2:55 PM
> > Subject: RE: [Mip6] EAP in MIP
> > 
> > 
> > 
> >>James,
> >>The point though is that we are using EAP in this case specifically
> >>for
> > 
> > MIP6. If we don't want to run IKEv2 between the MN and HA, 
> this seems 
> > like a viable alternative.
> > 
> >>I do agree that EAP fits more naturally with IKEv2. But, when the
> >>usage is
> > 
> > specifically for setting up the mobility SA, it seems to me that it 
> > can be allowed.
> > 
> >>Vidya
> >>
> >>-----Original Message-----
> >>From: James Kempf [mailto:[email-masked]]
> >>Sent: Thursday, March 03, 2005 4:04 PM
> >>To: Narayanan Vidya-CVN065; [email-masked]
> >>Subject: Re: [Mip6] EAP in MIP
> >>
> >>
> >>Vidya,
> >>
> >>I believe this was discussed a couple years ago by the WG and
> >>explicitly
> > 
> > rejected.
> > 
> >>The difference between IKEv2 and MIP6 is that MIP6 is a mobility
> > 
> > management protocol and IKEv2 is a protocol for performing 
> > authentication, authorization, and key exchange. Thus, EAP 
> is a more 
> > natural match for IKEv2.
> > 
> >>            jak
> >>
> >>
> >>----- Original Message -----
> >>From: "Narayanan Vidya-CVN065" <[email-masked]>
> >>To: <[email-masked]>
> >>Sent: Thursday, March 03, 2005 1:03 PM
> >>Subject: [Mip6] EAP in MIP
> >>
> >>
> >>
> >>>All,
> >>>I was wondering if any thought has been given to transporting EAP
> >>>within
> >>
> >>Mobile IP to use EAP-based methods to establish the MN-HA SA. There
> >>are
> > 
> > some drafts on using PANA for MIP6 bootstrapping, which are 
> > interesting. Also, the draft on multi-hop EAP 
> > (draft-ohba-multihop-eap-00) that attempts at having 
> multiple IP hops 
> > between the PaC and the PAA. This is certainly very useful for a 
> > variety of applications.
> > 
> >>>What is really required for MIP to use EAP for dynamically creating
> >>>the
> >>
> >>MN-HA SA is that the HA serve as the EAP authenticator. Of 
> course, the
> > 
> > other option is where you derive an AMSK in EAP for MIP - but, this 
> > only works if the network access uses EAP-based authentication.
> > 
> >>>Just like IKEv2 supports the transport of EAP within the protocol,
> >>>what
> >>
> >>are the downsides for MIP supporting it? This will only be done at
> > 
> > bootstrapping time - so, the number of roundtrips taken to complete 
> > the SA creation is not a big issue (and it will really 
> depend on the 
> > EAP method chosen anyway).
> > 
> >>>Thanks,
> >>>Vidya
> >>>
> >>
> >>
> >>------------------------------------------------------------
> ----------
> >>----
> > 
> > --
> > 
> >>----
> >>
> >>
> >>
> >>>_______________________________________________
> >>>Mip6 mailing list
> >>>[email-masked]
> >>>https://www1.ietf.org/mailman/listinfo/mip6
> >>>
> >>
> >>
> > 
> > 
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
> 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6