Subject: RE: [Mip6] Should we add the requirements that arise from RFC 4285in the draft-ietf-mip6-aaa-ha-goals-03?

From: "Kent Leung \(kleung\)" <[email-masked]>
Date: Tue, 14 Nov 2006 12:08:23 -0800

My vote is YES.

I assume this question is intended for HA-AAA interface support for RFC
4285.  But it would be definitely nice to have standards-based AAA
attributes for bootstrapping in terms of completeness.   

Kent

-----Original Message-----
From: Vijay Devarapalli [mailto:[email-masked]] 
Sent: Tuesday, November 14, 2006 10:26 AM
To: Gopal Dommety (gdommety)
Cc: [email-masked]
Subject: Re: [Mip6] Should we add the requirements that arise from RFC
4285in the draft-ietf-mip6-aaa-ha-goals-03?

Gopal,

lets step back a bit. what is the point of adding of 4285-specific
requirements in draft-ietf-mip6-aaa-ha-goals? is it just for basic
4285 operation where the HA-AAAH interface is used for MN
authentication? or does it include bootstrapping for 4285 too?

will the requirements be added to
draft-ietf-mip6-aaa-ha-goals-03 just to capture all the requirements in
one place with no binding to develop any solutions yet?

other bootstrapping related questions, do we want to standardize
bootstrapping solutions for 4285 too? has the DIME WG agreed to
developing solutions for 4285-based MIP6 operation?

Vijay

Gopal Dommety (gdommety) wrote:
> Hello All,
>  
>     Wanted to get the MIP6 Working groups preference on whether we 
> should we add the requirements that arise from RFC 4285 in the   
> draft-ietf-mip6-aaa-ha-goals-03
>  
> We would like to hear the Working Groups opinion of the following
question:
>  
> Should we add the requirements that arise from RFC 4285 in the 
> draft-ietf-mip6-aaa-ha-goals-03?
>  
>  Please answer "yes" or "no" PS: In the IETF Mip6 WG meeting there 
> were
> 14 people for "yes" and 5 for "No".
>  
> Cheers,
> Gopal and Raj
> 
> 
> ----------------------------------------------------------------------
> --
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 14 Nov 2006 12:18:49 -0800

instead of assuming things, it would be good to
figure out what exactly we want to add to
draft-ietf-mip6-aaa-ha-goals. :)

Gopal?

Vijay

---

From: Madjid Nakhjiri <[email-masked]>
Date: Tue, 14 Nov 2006 15:10:52 -0800

Personally, I suspect that 4285 support simply needs a bunch of attributes.
I suggest people propose a couple of requirements related to 4285 support
and after that we could easily see if those can be added to the current set
of goals. Once we did that we can simply say the HA-AAAH support 4285.

Madjid

-----Original Message-----
From: Kent Leung (kleung) [mailto:[email-masked]] 
Sent: Tuesday, November 14, 2006 12:08 PM
To: Vijay Devarapalli; Gopal Dommety (gdommety)
Cc: [email-masked]
Subject: RE: [Mip6] Should we add the requirements that arise from RFC
4285inthe draft-ietf-mip6-aaa-ha-goals-03?

My vote is YES.

Kent

-----Original Message-----
From: Vijay Devarapalli [mailto:[email-masked]] 
Sent: Tuesday, November 14, 2006 10:26 AM
To: Gopal Dommety (gdommety)
Cc: [email-masked]
Subject: Re: [Mip6] Should we add the requirements that arise from RFC

Gopal,

Vijay

---

From: "Gerardo Giaretta" <[email-masked]>
Date: Tue, 14 Nov 2006 18:30:42 -0500

Current work in DIME WG is based on rfc3775/3776 and on the IPsec
bootstrapping solution. This has lead so far to a re-use of rfc4072
for EAP packets transport between HA and AAAH and STR/STA/ASR/ASR
re-use for the session management.

This means that in case rfc4285 is used, the Diameter application we
are designing cannot be used. The session management and authorization
part can be kept the same, but there would be a need to specify how
the HA authenticates the BUs in case of dynamic keying (something
similar to MIP4 approach).

So the question is: should the AAA requirements doc (and consequently
the DIME solution - but this is a question for DIME WG) list also that
the HA-AAA communication may be able to bootstrap and authenticate
rfc4285 security associations?

I hope this clarifies.

--Gerardo

---

From: Madjid Nakhjiri <[email-masked]>
Date: Wed, 15 Nov 2006 13:19:07 -0800

Hi Gerardo,

If you remember, the first time people asked this question, I said we should
simply be careful about rubber stamping the Dime drafts as supporting 4285.
Unless the HA-AAA goal doc includes specific requirements on supporting
4285, we should refrain from making the promise that Dime draft do too.
If we design something based on a requirement that excludes support for
4285, then the solution has no obligation to support it either. 

I am going to reiterate all my points.
1) "AAA goal/requirement document" means requirements for both RADIUS and
Diameter. Unless you want to change the name, we need to realize that this
document can 
a) create requirements that RADIUS cannot meet and hence rule out RADIUS for
MIP6 support (some of the current goals related to key transport fit that
category)
b) create requirement for all AAA functionality, i.e both requirements on
AAA functionality within HA and on AAA protocol. This means if an HA works
according to 4285, then the document needs to include requirement for
supporting 4285 as well. Dime drafts can come and state whether they fulfill
all requirements, including 4285 requirements. We already have two dime
drafts for two different designs.

Currently, the document seemed to be treated as "requirement for Dime
bootstrapping drafts". Is that the intention? The answer seems to be yes
from your email. So the HA-AAA goals is not a generic requirement goal for
MIP6. The current HA-AAA goals document should specifically state that it is
the requirements for Diameter EAP based solutions and not for 4285 to clear
all the issues above.

Personally I think support for 4285 is a lot simpler than people think, and
might not require much more than some AVPs and look similar to 4004 for MIP4
support in case of CCOA, but I have not done a detail analysis. If that is
true all 4285 needs in way of requirements is probably being allowed to have
some new AVPs (or possibly same as those used in MIP4). 

The problem of excluding these from HA-AAA goal is that you may need a new
Diameter MIP6 App ID for 4285, if the AVPs are brand new?

Hope THIS clarifies some more :)

Regards,

Madjid

-----Original Message-----
From: Gerardo Giaretta [mailto:[email-masked]] 
Sent: Tuesday, November 14, 2006 3:31 PM
To: Madjid Nakhjiri
Cc: Kent Leung (kleung); Vijay Devarapalli; Gopal Dommety (gdommety);
[email-masked]

I hope this clarifies.

--Gerardo

---

From: Basavaraj Patil <[email-masked]>
Date: Wed, 15 Nov 2006 15:29:02 -0600

Kent,

I would just like to emphasize here that the requirements that we want to
consider adding to the AAA-goals document has nothing to do with
bootstrapping when using RFC4285 with MIP6.

Rather, the requirements would be the ones that are limited to the
interaction between the HA and the AAA when RFC4285 is used.

-Raj

---

From: Basavaraj Patil <[email-masked]>
Date: Wed, 15 Nov 2006 15:32:14 -0600

Hi Madjid,

I agree that supporting RFC4285 may be just a matter fo ensuring that the
appropriate attributes or AVPs exist. However if we were to capture the
requirements, we would be able to point to existing attributes/AVPs that
solve the problem or specify then if needed.

At the MIP6 meeting, I think there was a comment that there may be a need
for a new Diameter application in some case (don't remember which specific
scenario). Maybe the requirements would flush out such a need if it exists.

-Raj

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Wed, 15 Nov 2006 22:38:49 +0100

Hi Madjid, 

you make things quite complicated. Gerardo and myself have asked the following question to the MIP6 working group: Should draft-ietf-mip6-aaa-ha-goals-03 say something about RFC 4285? Possible answers are:
a) Don't say anything about RFC 4285. 
b) Explicitly rule out support for RFC 4285. 
c) Explicitly support RFC 4285.  

If draft-ietf-mip6-aaa-ha-goals-03 has to support both, RFC 4285 and IKEv2/EAP based authentication, then that's fine with us. I know that this is not difficult todo. We just need to get the documents written in such a way. We just thought it is better to ask before we finish the documents and suddently get told that this was not in the scope of our work. 

Furthermore, nobody said that draft-ietf-mip6-aaa-ha-goals-03 only impacts the DIME work. It obviously also impacts the corresponding RADIUS work since we are supposed to align the two designs. We just came across this issue when we worked on the Diameter document. 

Ciao
Hannes

> -----Ursprüngliche Nachricht-----
> Von: Madjid Nakhjiri [mailto:[email-masked]] 
> Gesendet: Mittwoch, 15. November 2006 22:19
> An: 'Gerardo Giaretta'
> Cc: 'Gopal Dommety (gdommety)'; 'Kent Leung (kleung)'; 
> [email-masked]; [email-masked]
> Betreff: [Dime] RE: [Mip6] Should we add the requirements 
> that arise from RFC 4285inthe draft-ietf-mip6-aaa-ha-goals-03?
> 
> Hi Gerardo,
> 
> 
> > and after that we could easily see if those can be added to 
> the current
> set
> DiME mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dime
>

---

From: Basavaraj Patil <[email-masked]>
Date: Wed, 15 Nov 2006 16:03:37 -0600

I think Madjid has raised a good point here. To restate the MIP6 WGs charter
objective: The AAA goals I-D is intended to capture requirements (or goals
which is the terminology used here) for MIP6 that are generic, i.e the
actual AAA solution may be based on Radius or Diameter. And there may be
requirements that can be met only by Diameter (as Madjid has mentioned
below), but that can be stated in the solution doc. But the requirements are
not intended to be limited for consideration by the DIME WG only.

-Raj

---

From: Madjid Nakhjiri <[email-masked]>
Date: Wed, 15 Nov 2006 14:50:41 -0800

Hi Raj,

Please see below,

Regards,

Madjid

-----Original Message-----
From: Basavaraj Patil [mailto:[email-masked]] 
Sent: Wednesday, November 15, 2006 1:32 PM
To: ext Madjid Nakhjiri; Kent Leung (kleung); 'Vijay Devarapalli'; Gopal
Dommety
Cc: [email-masked]

Hi Madjid,

Madjid>>I agree, I was saying that for the sake of better "requirement
design", people should actually define what 4285 requirements are rather
than simply saying 4285 should be supported. And my point was 4285
requirements are probably just one or two simple ones that should be added
to the goal draft, so that we have a generic HA-AAA goal document.

Madjid>>that is very possible, if 4285 requires mandatory attributes (say
for carrying keys/nonces) that are different from 4004 and whatever Dime
drafts come up with, then we need a new Application, but that is not the
concern of a generic requirement document, imho.

-Raj

---

From: Madjid Nakhjiri <[email-masked]>
Date: Wed, 15 Nov 2006 14:58:07 -0800

Well, NO pun intended, but I am not sure what is so complicated about this,
anybody who has gone through a product cycle does a requirement first and
then the design based on the requirements...

I reacted to voting on whether Dime drafts/ designs should/must support
4285, without specifying what 4285 requirements are and without including
these requirements into the generic design document. That is poor
salesmanship promising something that your product may or may not do. Comes
IESG review, this will come back and bite us.

Then people started voting on support of 4285 in the requirements without
specifying what 4285 needs are.

>From what I understood the intention of aaa-ha goal doc is (based on Raj's
comments), it is generic and should include 4285 support (as a SHOULD, or
whatever the applicability statement says). So none of your options below:)

Then the Dime drafts can simply say that they don't support that "SHOULD"
requirements.

I don't have a strong opinion on whether 4285 is very important or not, but
I think we should follow a design process, we can answer for, later.

Regards,

Madjid

-----Original Message-----
From: Tschofenig, Hannes [mailto:[email-masked]] 
Sent: Wednesday, November 15, 2006 1:39 PM
To: Madjid Nakhjiri; Gerardo Giaretta
Cc: Gopal Dommety (gdommety); Kent Leung (kleung); [email-masked];
[email-masked]
Subject: AW: [Dime] RE: [Mip6] Should we add the requirements that arise
from RFC 4285inthe draft-ietf-mip6-aaa-ha-goals-03?

Hi Madjid, 

you make things quite complicated. Gerardo and myself have asked the
following question to the MIP6 working group: Should
draft-ietf-mip6-aaa-ha-goals-03 say something about RFC 4285? Possible
answers are:
a) Don't say anything about RFC 4285. 
b) Explicitly rule out support for RFC 4285. 
c) Explicitly support RFC 4285.  

If draft-ietf-mip6-aaa-ha-goals-03 has to support both, RFC 4285 and
IKEv2/EAP based authentication, then that's fine with us. I know that this
is not difficult todo. We just need to get the documents written in such a
way. We just thought it is better to ask before we finish the documents and
suddently get told that this was not in the scope of our work. 

Furthermore, nobody said that draft-ietf-mip6-aaa-ha-goals-03 only impacts
the DIME work. It obviously also impacts the corresponding RADIUS work since
we are supposed to align the two designs. We just came across this issue
when we worked on the Diameter document. 

Ciao
Hannes

---

From: "Julien Bournelle" <[email-masked]>
Date: Fri, 17 Nov 2006 17:00:16 +0100

Hi madjid, all,

> 4285, then the solution has no obligation to support it either.

 can't we have requirements for 4285 in aaa-ha-goals and have separate
AAA solutions for IPsec and 4285 case ?

> MIP6 support (some of the current goals related to key transport fit that

 what do you propose ?

> the requirements for Diameter EAP based solutions and not for 4285 to clear

 this was not the intention.

> Diameter MIP6 App ID for 4285, if the AVPs are brand new?

 For the Diameter case, I think we may need another application to
support 4285. But i don't think that the problem of the mip6 WG. I
think we could have some requirements for 4285 in aaa-ha-goals and
then it's up to related AAA groups to deal with that.

 regards,

 Julien

---

From: Madjid Nakhjiri <[email-masked]>
Date: Fri, 17 Nov 2006 08:13:17 -0800

Hi Julien,

-----Original Message-----
From: Julien Bournelle [mailto:[email-masked]] 
Sent: Friday, November 17, 2006 8:00 AM
To: Madjid Nakhjiri
Cc: Gerardo Giaretta; Gopal Dommety (gdommety); Kent Leung (kleung);
[email-masked]; [email-masked]
Subject: Re: [Dime] RE: [Mip6] Should we add the requirements that arise
from RFC 4285inthe draft-ietf-mip6-aaa-ha-goals-03?

Hi madjid, all,

Madjid>>Absolutely, especially if the requirement for 4285 support is not
MUST, and from Raj that seems to be the case. However, the 4285 experts
should add a few words about what these requirements are. 

 what do you propose ?

Madjid>>I am proposing to the remove the goal that requires secure key
transport (I had a discussion on that with Gerarado already, I believe it
was called a general goal) and just leave the note in the security
consideration section. That way, RADIUS is not ruled out unintentionally.

Madjid>> seems to be the outcome:)

Madjid>>Again, I feel that only AVPs are needed, but I am not sure. We
(people who want 4285) need to look closely and see whether these AVPs can
be supported by 4004 or by the future RFCs supporting IKEv2 solutions. If it
turns out we need mandatory AVPs that cannot be supported by these RFCs that
we need a new Diameter application. And yes, all this means the work is to
be done in Dime, if there is enough interest. 

Regards,

Madjid

 regards,

 Julien