Subject: RE: [Mip6] EAP in MIP

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Fri, 4 Mar 2005 11:15:27 -0600

Bootstrapping the HA address can be done through DNS or other means. Also, the home address can be allocated using the MN Identifier Option, for instance. So, I see network access agnostic methods for both these cases. Creation of the SA seems to be the only thing that currently does not have a mechanism separate from network entry. 

Vidya

-----Original Message-----
From: James Kempf [mailto:[email-masked]] 
Sent: Friday, March 04, 2005 11:03 AM
To: Vijay Devarapalli; Narayanan Vidya-CVN065
Cc: [email-masked]
Subject: Re: [Mip6] EAP in MIP

Precisely.

Additionally, even if it did, there still would need to be some way to bootstrap the HA address and home address. It's not even possible to send a mobility header to the HA if the HA's address is unknown. The EAP-on-network-entry technique provides that.

            jak

----- Original Message ----- 
From: "Vijay Devarapalli" <[email-masked]>
To: "Narayanan Vidya-CVN065" <[email-masked]>
Cc: "'James Kempf'" <[email-masked]>; <[email-masked]>
Sent: Thursday, March 03, 2005 5:39 PM
Subject: Re: [Mip6] EAP in MIP

> Narayanan Vidya-CVN065 wrote:
>
> >
> > Being an EAP authenticator should not be a huge overhead for the HA 
> > - it
is a lightweight functionality and it allows HA and MN to have the SA at the end of it.
>
> HA being an EAP authenticator is a non-issue. the real
> issue is wether it makes sense carrying EAP using
> mobility header messages
>
> Vijay
>
> >
> > Vidya
> >
> >
> > -----Original Message-----
> > From: James Kempf [mailto:[email-masked]]
> > Sent: Thursday, March 03, 2005 5:22 PM
> > To: Narayanan Vidya-CVN065; [email-masked]
> > Subject: Re: [Mip6] EAP in MIP
> >
> >
> > Vidya,
> >
> > I think it makes more sense to keep the two functionally separated. 
> > It
is architecturally cleaner. Thus, one can have multiple kinds of deployment
> > models: integrated mobility and access service provider, separated
mobility and access service provider; and furthermore can separate out the mobility service authorizer from the mobility service provider. If the signaling is integrated, that's not possible.
> >
> > I know 3GPP2 likes having the mobility management signaling and the
authentication signaling combined, as is the case for MIP4. Their case is one of always having integrated mobility and access service provider, always having integrated mobility and access service authorizer, and, furthermore, the local and home networks trust each other so much that they allow unsecured authentication material to be transferred between them (from HLR to VLR). I believe we can accommodate their needs using the EAP on network entry protocol defined in draft-giaretta, and, furthermore, the result will be more secure.
> >
> >             jak
> >
> >
> >
> > ----- Original Message -----
> > From: "Narayanan Vidya-CVN065" <[email-masked]>
> > To: "'James Kempf'" <[email-masked]>; <[email-masked]>
> > Sent: Thursday, March 03, 2005 2:55 PM
> > Subject: RE: [Mip6] EAP in MIP
> >
> >
> >
> >>James,
> >>The point though is that we are using EAP in this case specifically 
> >>for
> >
> > MIP6. If we don't want to run IKEv2 between the MN and HA, this 
> > seems
like a viable alternative.
> >
> >>I do agree that EAP fits more naturally with IKEv2. But, when the 
> >>usage is
> >
> > specifically for setting up the mobility SA, it seems to me that it 
> > can
be allowed.
> >
> >>Vidya
> >>
> >>-----Original Message-----
> >>From: James Kempf [mailto:[email-masked]]
> >>Sent: Thursday, March 03, 2005 4:04 PM
> >>To: Narayanan Vidya-CVN065; [email-masked]
> >>Subject: Re: [Mip6] EAP in MIP
> >>
> >>
> >>Vidya,
> >>
> >>I believe this was discussed a couple years ago by the WG and 
> >>explicitly
> >
> > rejected.
> >
> >>The difference between IKEv2 and MIP6 is that MIP6 is a mobility
> >
> > management protocol and IKEv2 is a protocol for performing
authentication, authorization, and key exchange. Thus, EAP is a more natural match for IKEv2.
> >
> >>            jak
> >>
> >>
> >>----- Original Message -----
> >>From: "Narayanan Vidya-CVN065" <[email-masked]>
> >>To: <[email-masked]>
> >>Sent: Thursday, March 03, 2005 1:03 PM
> >>Subject: [Mip6] EAP in MIP
> >>
> >>
> >>
> >>>All,
> >>>I was wondering if any thought has been given to transporting EAP 
> >>>within
> >>
> >>Mobile IP to use EAP-based methods to establish the MN-HA SA. There 
> >>are
> >
> > some drafts on using PANA for MIP6 bootstrapping, which are 
> > interesting.
Also, the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that attempts at having multiple IP hops between the PaC and the PAA. This is certainly very useful for a variety of applications.
> >
> >>>What is really required for MIP to use EAP for dynamically creating 
> >>>the
> >>
> >>MN-HA SA is that the HA serve as the EAP authenticator. Of course, 
> >>the
> >
> > other option is where you derive an AMSK in EAP for MIP - but, this 
> > only
works if the network access uses EAP-based authentication.
> >
> >>>Just like IKEv2 supports the transport of EAP within the protocol, 
> >>>what
> >>
> >>are the downsides for MIP supporting it? This will only be done at
> >
> > bootstrapping time - so, the number of roundtrips taken to complete 
> > the
SA creation is not a big issue (and it will really depend on the EAP method chosen anyway).
> >
> >>>Thanks,
> >>>Vidya
> >>>
> >>
> >>
> >>--------------------------------------------------------------------
> >>--
> >>----
> >
> > --
> >
> >>----
> >>
> >>
> >>
> >>>_______________________________________________
> >>>Mip6 mailing list
> >>>[email-masked]
> >>>https://www1.ietf.org/mailman/listinfo/mip6
> >>>
> >>
> >>
> >
> >
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
>
>
>

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6