Subject: [AAA-WG]: Downloading keys from AAAF

From: Pat Calhoun <[email-masked]>
Date: Mon, 30 Apr 2001 10:19:19 -0700

> In the case where the MN is roaming within a foreign domain,
> a Registration is sent and an AMR is be sent to the AAAF. Then the
> AAAF returns the keys to the new FA without authenticating
> the MN. That seems to be a "problem". However, if it would reach 
> the Home server, then the MN could be authenticated based on
> the MIP-MN-AAA-Auth AVP, which could decide if it is a valid
> request for reporting a roaming situation.

This in itself is not a problem.

When the keys are downloaded from the AAAF to the FA, which btw is in
the same administrative domain, the FA would authenticate the mobile's
Registration Request, via the MN-FA auth ext. So, if the mobile was a
malicious one, the authentication would fail.

However, if the AAAF maintains state, and believes that the request from
the FA means that the mobile has moved, and updates its state information,
then this is a serious problem.

This comes back to my post earlier today, where this information SHOULD
be handled via a context transfer, and this functionality should be
removed from Diameter.

PatC