Subject: Re:[mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.1

From: Shaji Radhakrishnan <[email-masked]>
Date: Thu, 5 Jul 2001 17:45:48 -0400

Hi JH Song,
 
I have a small doubt regarding your draft.
 
According to RFC 3012, each re-registration by the mobile node SHOULD use
different 
challenge provided by the Foreign Agent (either in Agent advertisements or
last registration reply).
From your draft it is not clear that  the mobile node continue using the
old key generated from the old challenge
(i.e , the very first challenge in the advertisement) or each generate a
new key based on the new challenge
received in the reply or advertisements. One solutions to this is that HA
must also check the received challenge
value in the registration request, along with NAI and or Home IP address.
 
Also if mobile node is using new key (since it used the new challenge) in
the re-registration, it MUST include
the NAI in the registration request eventhough MN-AAA extension is not
present, and only MN-HA authentication extension
is present. Then only AAAh can compute the key in this re-registration case.
 
Thanks
- shaji

-----Original Message-----
From: junhyuk song [mailto:[email-masked]]
Sent: Wednesday, July 04, 2001 8:14 PM
To: [email-masked]
Subject: [mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.1

Hi All,

We recently submitted the revision of Internet draft draft on "MIPv4
Authentication Shared Secret Generation.
 
draft-song-mobileip-mipv4-auth-secgeneration-01.txt  

Regards,
JH SONG

---

From: "junhyuk song" <[email-masked]>
Date: Fri, 6 Jul 2001 19:20:48 +0900

Hi Shaji,

Please read my comment below,

  ----- Original Message ----- 
  From: Shaji Radhakrishnan 
  To: [email-masked]' 
  Sent: Friday, July 06, 2001 6:45 AM
  Subject: Re:[mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.1

  Hi JH Song,

  According to RFC 3012, each re-registration by the mobile node SHOULD use different 
  challenge provided by the Foreign Agent (either in Agent advertisements or last registration reply).
  From your draft it is not clear that  the mobile node continue using the old key generated from the old challenge
  (i.e , the very first challenge in the advertisement) or each generate a new key based on the new challenge
  received in the reply or advertisements. One solutions to this is that HA must also check the received challenge
  value in the registration request, along with NAI and or Home IP address.

  The MN will be using new challenge for creating MN-HA shared that came along RRP upon every re-registration.
  However, it is not necessary to keep updating MN-HA shared key upon every re-registration, 
  because MN-HA shared key can be used until user terminate the MIP session.  
  In addition if the optional lifetime of MN-HA key is used, 
  MN and HA will refresh MN-HA shared key only if the MN-HA share key lifetime is expired.
  Please see section 4, Key Management of our Internet Draft 0.1 version.

  Also if mobile node is using new key (since it used the new challenge) in the re-registration, it MUST include
  the NAI in the registration request eventhough MN-AAA extension is not present, and only MN-HA authentication extension
  is present. Then only AAAh can compute the key in this re-registration case.

  If your concern is not resolved until you read this, I must be misunderstand your question.

  The reason I use the NAI rather than IP address on computing MN-HA shared key is to support Dynamic MIP case.
  In that case, NAI must be presence, therefore NAI can be replaced by MN IP address. 
  And RFC-3012 state the case HA received MN-AAA authentication with FAC extension.
  Besides, AAA is the entity that create the new MN-HA shared key, HA shall fetch or receive MN-HA shared key from AAA.

  Could you elaborate your question?

  Regards,
  JH SONG

  Thanks
  - shaji

    -----Original Message-----
    From: junhyuk song [mailto:[email-masked]]
    Sent: Wednesday, July 04, 2001 8:14 PM
    To: [email-masked]
    Subject: [mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.1

    Hi All,

    We recently submitted the revision of Internet draft draft on "MIPv4 Authentication Shared Secret Generation.

    Regards,
    JH SONG

---

From: "Chae-yong Chong" <[email-masked]>
Date: Sat, 7 Jul 2001 09:18:51 +0900

I summarize the new extensions for Mobile IP registration.
You can see the NAI is authenticated with the MN-HA authentication extension.
Therefore NO MN-AAA authentication extension is required to authenticate NAI extension.

If Mobile Node do the re-generation a shared key, it include MN-AAA extension to authenticate
a FAC which is used in new key generation and HA should authenticatie the FAC by asking AAAh
to validate the MN-AAA authentication extension to AAAh.

from rfc3012
------------

In either case, the MN-FA Challenge extension and one of the above
specified authentication extensions MUST follow the Mobile-Home
Authentication extension, if present.
-> MN-HA | FAC

Furthermore, the Foreign Agent MUST check that there is either
a Mobile-Foreign, or a MN-AAA Authentication extension after
the Challenge extension. 
-> FAC | MN-FA or MN-AAA

If present, the Mobile-HA Authentication Extension MUST appear prior to the
MN-AAA Authentication extension. 
-> MN-HA | MN-AAA

from RFC 2794
--------------

The Mobile Node NAI extension MUST appear in the Registration Request
before both the Mobile-Home Authentication extension and Mobile-
Foreign Authentication extension, if present.
-> NAI | MN-HA

=> NAI | MN-HA | FAC | MN-FA | MN-AAA

If the foreign agent includes
this extension in a successful Registration Reply, the extension
SHOULD precede a MN-FA authentication extension.
-> new FAC | MN-FA

Thanks.
cychong
  ----- Original Message ----- 
  From: Shaji Radhakrishnan 
  To: [email-masked]' 
  Sent: Friday, July 06, 2001 6:45 AM
  Subject: Re:[mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.1

  Hi JH Song,

   
   
  Thanks
  - shaji
   
    -----Original Message-----
    From: junhyuk song [mailto:[email-masked]]
    Sent: Wednesday, July 04, 2001 8:14 PM
    To: [email-masked]
    Subject: [mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.1

    Hi All,

    Regards,
    JH SONG