Subject: RE: [Mip6] EAP in MIP

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Fri, 4 Mar 2005 00:46:29 -0600

That is a good point. If such a scrub hasn't already been done, perhaps there is some value in looking at all the technical limitations of MIP6 in carrying EAP? 

Vidya

-----Original Message-----
From: Yoshihiro Ohba [mailto:[email-masked]] 
Sent: Thursday, March 03, 2005 4:31 PM
To: Narayanan Vidya-CVN065
Cc: 'James Kempf'; [email-masked]
Subject: Re: [Mip6] EAP in MIP

EAP requires a transport that provides orderly delivery.  Both PANA and IKEv2 satisfy the EAP transport requirement (PANA and IKEv2 actually provide not only orderly delivery, but also reliable transport of EAP messages).  I don't think it is easy to change Mobile IPv6 signaling to satisfy the EAP transport requirement.

Yoshihiro Ohba

On Thu, Mar 03, 2005 at 05:43:51PM -0600, Narayanan Vidya-CVN065 wrote:
> James,
> I am actually not proposing an alternative to draft-giaretta. I am 
> just wondering if mip6 optionally allowed EAP to be carried, it will help in cases where the mobile node is powering up on an access network that does not use EAP for authentication.
> 
> I am concerned that by only defining the derivation of the MSA via the 
> network access EAP procedure, the applicability of EAP for this is limited to those mobile nodes that bootstrap on a network supporting EAP. By optionally also providing a provision in mip6, the MN can decide based on what it does for network access whether or not to include it in the MIP6 message.
> 
> This still preserves the 3-party authentication model. In my mind, the 
> mobility service authorizer in this case is really the AAA server - so, this is still separate from the mobility serivce provider, no? It is only a question of which entity does the function of an EAP authenticator - I'm suggesting that the HA must be able to provide this function for those mobile nodes that need it.
> 
> Being an EAP authenticator should not be a huge overhead for the HA - 
> it is a lightweight functionality and it allows HA and MN to have the SA at the end of it.
> 
> Vidya
> 
> 
> -----Original Message-----
> From: James Kempf [mailto:[email-masked]]
> Sent: Thursday, March 03, 2005 5:22 PM
> To: Narayanan Vidya-CVN065; [email-masked]
> Subject: Re: [Mip6] EAP in MIP
> 
> 
> Vidya,
> 
> I think it makes more sense to keep the two functionally separated. It 
> is architecturally cleaner. Thus, one can have multiple kinds of deployment
> models: integrated mobility and access service provider, separated mobility and access service provider; and furthermore can separate out the mobility service authorizer from the mobility service provider. If the signaling is integrated, that's not possible.
> 
> I know 3GPP2 likes having the mobility management signaling and the 
> authentication signaling combined, as is the case for MIP4. Their case 
> is one of always having integrated mobility and access service 
> provider, always having integrated mobility and access service 
> authorizer, and, furthermore, the local and home networks trust each 
> other so much that they allow unsecured authentication material to be 
> transferred between them (from HLR to VLR). I believe we can 
> accommodate their needs using the EAP on network entry protocol 
> defined in draft-giaretta, and, furthermore, the result will be more 
> secure.
> 
>             jak
> 
> 
> 
> ----- Original Message -----
> From: "Narayanan Vidya-CVN065" <[email-masked]>
> To: "'James Kempf'" <[email-masked]>; <[email-masked]>
> Sent: Thursday, March 03, 2005 2:55 PM
> Subject: RE: [Mip6] EAP in MIP
> 
> 
> > James,
> > The point though is that we are using EAP in this case specifically
> > for
> MIP6. If we don't want to run IKEv2 between the MN and HA, this seems 
> like a viable alternative.
> >
> > I do agree that EAP fits more naturally with IKEv2. But, when the
> > usage is
> specifically for setting up the mobility SA, it seems to me that it 
> can be allowed.
> >
> > Vidya
> >
> > -----Original Message-----
> > From: James Kempf [mailto:[email-masked]]
> > Sent: Thursday, March 03, 2005 4:04 PM
> > To: Narayanan Vidya-CVN065; [email-masked]
> > Subject: Re: [Mip6] EAP in MIP
> >
> >
> > Vidya,
> >
> > I believe this was discussed a couple years ago by the WG and
> > explicitly
> rejected.
> >
> > The difference between IKEv2 and MIP6 is that MIP6 is a mobility
> management protocol and IKEv2 is a protocol for performing 
> authentication, authorization, and key exchange. Thus, EAP is a more natural match for IKEv2.
> >
> >             jak
> >
> >
> > ----- Original Message -----
> > From: "Narayanan Vidya-CVN065" <[email-masked]>
> > To: <[email-masked]>
> > Sent: Thursday, March 03, 2005 1:03 PM
> > Subject: [Mip6] EAP in MIP
> >
> >
> > > All,
> > > I was wondering if any thought has been given to transporting EAP
> > > within
> > Mobile IP to use EAP-based methods to establish the MN-HA SA. There
> > are
> some drafts on using PANA for MIP6 bootstrapping, which are 
> interesting. Also, the draft on multi-hop EAP (draft-ohba-multihop-eap-00) that attempts at having multiple IP hops between the PaC and the PAA. This is certainly very useful for a variety of applications.
> > >
> > > What is really required for MIP to use EAP for dynamically 
> > > creating
> > > the
> > MN-HA SA is that the HA serve as the EAP authenticator. Of course, 
> > the
> other option is where you derive an AMSK in EAP for MIP - but, this 
> only works if the network access uses EAP-based authentication.
> > >
> > > Just like IKEv2 supports the transport of EAP within the protocol,
> > > what
> > are the downsides for MIP supporting it? This will only be done at
> bootstrapping time - so, the number of roundtrips taken to complete 
> the SA creation is not a big issue (and it will really depend on the EAP method chosen anyway).
> > >
> > > Thanks,
> > > Vidya
> > >
> >
> >
> > --------------------------------------------------------------------
> > --
> > ----
> --
> > ----
> >
> >
> > > _______________________________________________
> > > Mip6 mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/mip6
> > >
> >
> >
> 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6