Subject: [AAA-WG]: Re: Proposed Text for Issue 91 (KDC)

From: Joe Lau <[email-masked]>
Date: Thu, 19 Jul 2001 11:04:53 -0700 (PDT)

Pat,

I have a question on your recent proposed text for Issue 91 (KDC)

> Below is my proposed text for this issue. 
> ...
>
> 6.1 MIP-FA-to-MN-Key AVP
>
> ...
>
>  MIP-FA-to-MN-Key ::== <AVP Header: 326 >
>                        { MIP-Peer-SPI }
>                        { MIP-Algorithm-Type }
>                        { MIP-Session-Key }
>		       * [ AVP]
>
> 6.5 MIP-MN-to-FA-Key AVp
>
> ...
>
>  MIP-MN-to-FA-Key ::== <AVP Header: 326 >
>                        { MIP-Algorithm-Type }
>                        { MIP-Replay-Mode }
>                        { MIP-Session-Key }
>		       * [ AVP]

How come MIP-FA-to-MN-Key, unlike MIP-MN-to-FA-Key, has no 
MIP-Replay-Mode AVP? 

Similar problem for the "6.2 MIP-FA-to-HA-Key AVP".

Thanks for the clarification.

Joe

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 19 Jul 2001 10:53:53 -0700

> Similar problem for the "6.2 MIP-FA-to-HA-Key AVP".

RFC 2002 provides MN-HA replay protection only, via either timestamps
or nonces. The protocol doesn't provide such replay protection 
between MN-FA and FA-HA. The Challenge extension provides the MN-FA
replay protection, but that is well before the registration request
has even been sent, so sending this info in AAA is pointless.

PatC