Subject: [mobile-ip] Re: [AAA-WG]: Re: Proposed Text for Issue 91 (KDC)

From: Joe Lau <[email-masked]>
Date: Thu, 19 Jul 2001 11:22:44 -0700 (PDT)

Pat,

> RFC 2002 provides MN-HA replay protection only, via either timestamps
> or nonces. The protocol doesn't provide such replay protection 
> between MN-FA and FA-HA. 

But then why MIP-MN-to-FA-Key had a MIP-Replay-Mode AVP?
Similar problem on MIP-HA-to-FA-Key AVP.

> > >  MIP-MN-to-FA-Key ::== <AVP Header: 326 >
> > >                        { MIP-Algorithm-Type }
> > >                        { MIP-Replay-Mode }   <=========== Here
> > >                        { MIP-Session-Key }
> > >		           * [ AVP]

I am still puzzled.
Thanks in advance for the clarification again.
 
Joe

---------------------- Origial email ------------------------

> > I have a question on your recent proposed text for Issue 91 (KDC)
> > 
> > > Below is my proposed text for this issue. 
> > > ...
> > >
> > > 6.1 MIP-FA-to-MN-Key AVP
> > >
> > > ...
> > >
> > >  MIP-FA-to-MN-Key ::== <AVP Header: 326 >
> > >                        { MIP-Peer-SPI }
> > >                        { MIP-Algorithm-Type }
> > >                        { MIP-Session-Key }
> > >		       * [ AVP]
> > >
> > > 6.5 MIP-MN-to-FA-Key AVp
> > >
> > > ...
> > >
> > >  MIP-MN-to-FA-Key ::== <AVP Header: 326 >
> > >                        { MIP-Algorithm-Type }
> > >                        { MIP-Replay-Mode }
> > >                        { MIP-Session-Key }
> > >		           * [ AVP]
> > 
> > How come MIP-FA-to-MN-Key, unlike MIP-MN-to-FA-Key, has no 
> > MIP-Replay-Mode AVP? 
> > 
> > Similar problem for the "6.2 MIP-FA-to-HA-Key AVP".
> 
> RFC 2002 provides MN-HA replay protection only, via either timestamps
> or nonces. The protocol doesn't provide such replay protection 
> between MN-FA and FA-HA. The Challenge extension provides the MN-FA
> replay protection, but that is well before the registration request
> has even been sent, so sending this info in AAA is pointless.
> 
> PatC
> > 
> > Thanks for the clarification.
> > 
> > Joe
> > 
>

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 19 Jul 2001 11:29:54 -0700

An oversight. This will have to be taken care of during the last call
phase.

Thanks,

PatC