Subject: RE: [AAA-WG]: Issue 91: MIP SPI

From: "Martin Julien (ECE)" <[email-masked]>
Date: Fri, 29 Jun 2001 09:59:12 +0200

> > The easy solution would be to leave that selection of the SPIs to
> > the HA, since the AAA does not really care about it. In 
> fact, the AAA
> > can still put everything it requires for security, in terms 
> of algorithms,
> > replay-mode, key material, but should not care about the 
> SPI. That would 
> > mean that the HA would become responsible for looking at 
> the Registration
> > message, extract the Preferred-SPI itself from the MN, and 
> select the SPI and create
> > a new one. The thing is that the HA is the one that owns 
> the SA with the
> > MN and the HA, right? I don't see the point for the AAA to 
> take a chance 
> > by chosing one that can possibly not be a valid one for the 
> HA's SAs?
> 
> This is a possibility.
> 

And that is my favorite option. 

The HA would select a SPI for the MN-HA SA and the FA-HA SA.
The thing is that it is not so easy for the FA to suggest a
Preferred HA-FA SPI, since it might not know the HA yet, since
it needs to be allocated by the AAAH. The HA-FA SPI, allocated by the
HA, could be returned in the HAA, to inform the AAAH about it,
so that it can include it in the FA-HA Key AVP destined to the FA.
In that example, there is no need for a Preferred HA-FA SPI, neither
for a Preferred HA-MN SPI, right?

The FA would then be responsible for allocating the SPI of the SA 
between the FA and the MN. In the AMR, the FA would include the 
allocated FA-MN SPI for the AAAF to keep the SPI value, in case
it supports returning an existing set of Session keys a new
FA, when the MN is roaming. In that example, there is no need for 
a Preferred MN-FA SPI, right?

> > That means that HA would be responsible of the SPI field of the 
> > "Unsolicited MN-HA Key from AAA Subtype" and the 
> "Unsolicited MN-FA Key 
> > from AAA Subtype". The Preferred-SPI AVPs would become 
> obsolete, since
> > the HA could extract directly that information from the 
> Registration 
> > message. Furthermore, the FA does not need to suggest an 
> SPI, since the
> > HA would know the SPI available for the SA with the FA, if 
> it receives
> > the MIP-Foreign-Agent-Host AVP. The HA would need to return 
> the selected
> > SPIs for the FA-HA and the FA-MN Session key AVPs, so that 
> the AAA can return
> > them to the FA in a secured manner, if required.
> > 
> > Does that make sense or not?
> 
> ok, so the Diameter draft could state that the AAAH still 
> inserts an SPI, but
> the HA is allowed to override that value if it is deemed 
> necessary. Would this
> work?

I think so, but I still do not see the need for the AAAH to be
involved at all in that allocation, not even in forwarding the
Preferred-SPI.

> > > > Of course, the AAA can count on the Preferred-SPI from the FA
> > > > and the MN, in which case the AAA simply agrees with the 
> > > value. However,
> > > > if there is no Preferred-SPI AVPs in the AMR, then the 
> AAAH needs to
> > > > generate
> > > > them, at the risk that they might already be used in the SA 
> > > defined between
> > > > the MN and the HA, or between the HA and the FA, or between 
> > > the FA and the
> > > > MN.
> > > > I think that it makes more sense for the HA to select the 
> > > required SPI
> > > > between
> > > > the HA-MN and HA-FA, if no Preferred-SPI is included in the AMR.
> > > 
> > > No, IMHO, if not Preferred-SPI is present, then no key is 
> > > generated. So,
> > > perhaps some associated text in the Feature-Vector is needed?
> > 
> > That seems to contradicts what you were saying earlier about the
> > need for the AAA to generate new SPIs, right?, or am I understanding
> > you wrong?
> 
> Not sure. I think that the Preferred-SPIs MUST be present for 
> key request,
> since the SPIs are present in the MIP Key Request extension, so it is 
> trivial for an FA to include these values in the Diameter 
> message. I think
> that we should mandate that the FA include these values. What 
> do you think?

But maybe not the HA-FA SPI, in the case where you do not know the
HA yet?

> PatC

It depends if you agree with me that the Preferred-SPI AVPs are not required. 
I think we could use them, but since I don't see them very useful,
I think it would simplify the protocol to remove them and use an alternative
solution, which can never be wrong. Maybe you're thinking of something I 
have not realized yet, though?

Martin