Subject: [AAA-WG]: [Issue] Multi-roundtrip Mobile IP authentication

From: Pat Calhoun <[email-masked]>
Date: Fri, 1 Jun 2001 15:53:14 -0700

All,

While fixing Issue #32, I have had to add some provisions in the base protocol
to allow for multi-round authentication exchanges. The following Result-Code
was added to handle this case:

"     DIAMETER_ERROR_MULTI_ROUND_AUTH   1001
         This informational error is returned by a Diameter server to
         inform the access device that the authentication mechanism
         being used required multiple round trip, and a subsequent
         request needs to be issued in order for access to be granted."

Since the base now supports this, I have made the following change to
section 2.2 of the Mobile IP extension, which handles this specific
issue:

"An AMA message with the Result-Code set to DIAMETER_ERROR_MULTI_ROUND_AUTH
MAY include mobile node registration key AVPs (see Section 6.1) such as
the MIP-MN-to-FA-Key AVP and the MIP-MN-to-HA-Key AVP. If such an AVP
is present in the AMA message, the foreign agent MUST include the
corresponding Mobile IP key distribution extension in the Registration
Reply it sends to the mobile node. This is to support multi-roundtrip
authentication mechanisms."

Hopefully this one is dead.

Thanks,

PatC

---

From: Bernard Aboba <[email-masked]>
Date: Sat, 2 Jun 2001 14:51:48 -0700 (PDT)

Why is this an error message rather than being handled the same way that
multi-round trip EAP authentication is (e.g. by use of a Challenge
method)?

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 4 Jun 2001 06:41:48 -0700

> multi-round trip EAP authentication is (e.g. by use of a Challenge

I caught that over the weekend, and have since fixed it. It was a cut-and-paste
like error :(

PatC