Subject: Re: [mobile-ip] Generalized MN-HA and MN-FAKey Reply Extension

From: Joe Lau <[email-masked]>
Date: Mon, 30 Jul 2001 11:15:19 -0700 (PDT)

Hello Pat,

> Also you will notice that the MN-FA AAA subtype does include the missing
> lifetime. So, in the AAA case, both the MN-HA and the MN-FA have lifetimes.

Yes, I noticed that.  I was cusious on why lifetime not placed in the
Generalized MN-FA header.
 
And, as Charlie pointed out, the Home Agent may assign different values
to the MN-HA and MN-FA session key lifetime?   For example, MN-HA key
will have a lifetime = MIP-Authorization-Lifetime AVP and the MN-FA key
will have a lifetime = Registration lifetime.  The HA-FA key will have
a lifetime = MIP-Authoriztion-Lifetime.   

When the MN-FA key's lifetime expired before that of the MN-HA key, the MN 
will have to request another MN-FA key from the AAAH.   

Is this the intended scenario ?

Another question, let's say there are two MNs who belong to the same 
Home network (ie. AAAH).  Both MNs are visiting the same foreign network 
controlled by the same FA.  Both MNs have requested and got their
three pairs of session keys distributed:  MN-HA key, MN-FA key, and FA-HA key.

Is it possible that the FA-HA keys will have different lifetime or even
different key material for these two MNs?  In other words, FA-HA keys
used by these two MNs are independent of each other?

Thanks!

Joe Lau

> 
> PatC
> On Sun, Jul 29, 2001 at 11:16:45PM -0700, Charlie Perkins wrote:
> > 
> > Hello Joe,
> > 
> > These are generalized key extensions.  Subtypes will define more
> > data fields.  There is a good argument that some specific key
> > subtypes of the MN-FA Key Reply extension will NOT have
> > a lifetime, because the key will have the same lifetime as the
> > Mobile IP registration lifetime.  In fact, one could argue that
> > this would be the preferred mode of operation for the security
> > association between the mobile node and the foreign agent.
> > 
> > The security association between mobile node and home
> > agent is clearly different, and the lifetime of that association
> > would not typically be controlled by registration factors.
> > Since every security associatoin has to have a lifetime, and
> > there isn't any likely implicit lifetime, it would be present for
> > every subtype, and thus belongs in the generalized extension.
> > 
> > At least that's my understanding!
> > 
> > Regards,
> > Charlie P.
> > 
> > 
> > Regards,
> > Charlie P.
> > 
> > 
> > 
> > Joe Lau wrote:
> > 
> > > Hello Charlie and Pat,
> > >
> > > On your latest draft <draft-ietf-mobileip-gen-key-01.txt>,
> > > I am puzzled over the asymmetry between the MN-HA Key Reply Extension
> > > and the MN-FA Key Reply Extension.   The former has a lifetime field
> > > but the latter does not.  I understand that the lifetime of the
> > > MN-FA Key will come from the Unsolicited MN-FA Key Material From AAA Subtype.
> > >
> > > But I don't understand why these two keys have to be treated differently
> > > as far as how the lifetime is placed.
> > >
> > > Thanks in advance for your clarification.
> > >
> > > Regards,
> > >
> > > Joe Lau
> > 
>