Subject: [mobile-ip] MN-AAA Authentication Extension Clarification

From: "junhyuk song" <[email-masked]>
Date: Wed, 18 Jul 2001 10:41:59 +0900

Hi All,

Last week, 3GPP2 TSG-P workgroup decide to support Mobile IP security enhancement based on draft-ietf-mobileip-AAA-key-07 and draft-ietf-mobileip-gen-key-00 by Charles Perkins and Pat Calhoun, if those Internet Draft becomes proposed standard by PS0001B C3 timeline (September).

Since the default AAA server in IS-835 is based on RADIUS protocol, MN-HA key gernation by the Key Reply Mobile IP extension scheme requires some assumption and changes, such as Mobile Node MUST compute MN-HA authenticator by some arbitary value.

Most of all, now MN-AAA authentication SHOULD be mandatory because HA depends on MN-AAA authentication for initial MIP Register Request.
This is simply because MN doesn't have MN-HA shared key for the initial RRQ.

Currently there is RFC2002 bis 0.6 draft is available.  Unlike RFC-2002 now it requires "Exactly one authorization-enabling extension" rather than "Exactly one Mobile-Home Authentication Extension" (see section 3.8.2.1).

However, if you look at the section 3.5.2, 
it said  "Exactly one authorization-enabling extension MUST be present in all Registration Requests, and also in all Registration Replies generated by the Home Agent . 
 The Mobile-Home Authentication Extension is  always an authorization-enabling for registration messages specified in this document."

I believe authorization-enabling could mean both MN-HA and MN-AAA authentication.
If the future release of MIPv4 RFC doesn't support MN-AAA authentication from HA, it cannot accomodate either RFC-3012 or Key Reply MIP extension for RADIUS based AAA.  I wish RFC-2002 bis can clarify the support of MN-AAA authentication extension.

Regards,
JH SONG