Subject: Re: [MOBILE-IP] routing optimization authentication

From: Patrice Calhoun <[email-masked]>
Date: Fri, 13 Aug 1999 09:17:53 -0700

>
>
>>>> From: Patrice Calhoun <[email-masked]>
>>>
>>>> I certainly cannot dispute the fact that a full blown PKI has scaling
>>>advantages,
>>>> but it also has deployment problems. The reality of the fact is that the
>>>global PKI
>>>> is not here yet, and may be here 5+ years from now.
>>>
>>>
>>>  I don't see why the use of public-key style authentication in the
>>>  context of Mobile IP has to require a "global PKI". As Steve Kent
>>>  has also mentioned several times on the IPSec mailing list, deploying
>>>  PKI in a closed system isn't hard (it is more a mental block than
>>>  anything else).
>>>
>>>  Also consider the fact that there are several thousand (if not more)
>>>  HTTPS servers operating today using public-key technology.
>>>
>>>  vipul
>>
>>Because with the current plans of CDMA deployment, it really isn't a
>"closed"
>>network.
>>
>>PatC
>
>The current CDMA deployment is among a few major service providers
>and can be *considered* a "Closed" network for the purpose of
>discussion here. The organizations that intend on deploying Mobile IP
>need to take a serious look at the option of having a closed PKI
>system and the fact that it is very much a feasible solution. I agree
>with Vipul's thought here,  that deployment of Mobile IP by a group of
>service providers who can agree and thereby have a closed PKI
>system. Global roaming in the future will require supporting global
>PKI. But by the time we get to that point I believe we will have such
>an infrastructure in place.
>
The current AAA proposals that I've made allow for the broker to issue certificates
to all roaming partners, but not in the scale that you are talking about. In fact,
no cross-certs are necessary, unless inter-broker mobility is allowed.

As I stated earlier, even if that is the case the AAAF/AAAH are still needed
to make on-the-fly authorization decisions. A certificate alone will not be
sufficient for a foreign service provider to provide service to a mobile node.

PatC

---

From: Gopal Dommety <[email-masked]>
Date: Fri, 13 Aug 1999 09:58:16 -0700

> sufficient for a foreign service provider to provide service to a mobile node.

We will need for accounting reasons.  As for authorization, why cann't
the FA interact  with FAAA locally,  and HA with  the HAAA locally (to
avoid  the configuration  of authorization information   at the HA and
FA)?

Thanks
Gopal