Subject: [AAA-WG]: Re: Proposed Text for Issue 91

From: Guenter Schaefer <[email-masked]>
Date: Fri, 20 Jul 2001 16:55:00 +0200

Dear all,

I have just subscribed to the list today, as I stumbled over some
unclear points related to the session key distribution issue
in the internet draft "Diameter Mobile IPv4  Application".
This also relates to the proposed Text for Issue 91. 

To explain my questions, let's consider that,

 - Point A:
   Two or more mobile nodes from the same organization (home domain)
   want to register at the same foreign agent and all session keys 
   should be generated by the home AAA server. It is not unlikely,
   that they want to register at the same HA.
 - Point B:
   Later on, one of them makes a handover to another foreign
   agent, served by the same foreign AAA server, so that an optimized
   re-registration should take place (the mobile node includes
   the previous foreign agent address and wants to re-use the same
   session keys).

Regarding Point A, I have the impression that with the current
internet drafts two HA-FA keys, one for each mobile node will be
created and distributed. If the lifetime of these key would not
play a role, one key could be sufficient. However, if the FA-HA
security association should have a limited lifetime, then in fact
two keys may be required, as for example the two registrations 
do not need to occur at the same moment of time, and the SA needs
to be valid also during the entire lifetime of the SA HA-MN2
(considering MN2 is the second one to register). 

My first question related to this is, how does the current approach
to choosing the SPI guarantee the required uniqueness of the 
SPI at both peers (FA and HA)?

In IPSec an SPI always belongs to a unidirectional security 
association and it needs to be unique for the receiver side.
So the receiving side determines the SPI and a security association
is uniquely identified by the pair <SPI, destination address>.

The approach in the current internet draft seems to be a 
different one:

>    AAA support for key distribution departs slightly from the existing
>    SPI usage, as described in [4]. The SPI values are used as key
>    identifiers, meaning that each registration key has its own SPI
>    value; nodes that share a key also share an SPI. The Mobile Node
>    proposes SPIs for use in computing the Mobile-Foreign and 
>    Mobile-Home authentication extensions, via the Mobile IP AAA Key
>    Request extensions [15], while the Home Agent allocates the
>    Mobile-Foreign, Mobile-Home and Foreign-Home SPIs.
>
>    Once the registration keys have been distributed, subsequent Mobile
>    IP registrations need not invoke the AAA infrastructure until the
>    keys expire.  These registrations MUST include the Mobile-Home
>    authentication extension.  In addition, subsequent registrations 
>    MUST also include Mobile-Foreign authentication extension if the
>    Mobile-Foreign key was generated and distributed by AAA; 
>    similarly for subsequent use of the Foreign-Home authentication
>    extensions.

This model just works if an SA is identified by a triple
<SPI, source address, destination address> and for every key there
are two entries in the SA databases at both sides:
 - <SPI, source address, destination address>
 - <SPI, destination address, source address>

If an SA should be identified by only <SPI, destination address>, 
the above approach will not work, as the home agent does not have
complete knowledge of the SPIs in use at the foreign agent.

However, the use of the triple <SPI, source address, destination
address> raises another issue which occurs in the situation 
described as Point B (optimized local handover):

 - The new foreign agent needs an FA-HA key to HA of the MN performing
   the handover. For this he could either:
   - Alternative B.1: use an FA-HA key he already has established
     with the MN's home agent (following the idea "one key per 
     pair of entities"). However, this introduces a problem with
     the lifetime of the FAnew-HA key as it should be valid at least
     as long as the MN-HA key.
   - Alternative B.2: try to use the same FA-HA key the old foreign
     agent has used for this mobile node (following the idea
     "one FA-HA key per MN-session"). This key could be provided
     by the foreign AAA server, which also has to provide the 
     MN-FA key of the old foreign agent.

 - If alternative B.2 is to be realized, this creates a problem
   with the SPI: how will the home agent associate the key
   FAold-HA with the new foreign agent? 

One solution could be that the old-foreign-agent-extension is
carried over to the HA and that HA modifies the entries

 <SPI, FAold, HA>
 <SPI, HA, FAold>

to 
    
 <SPI, FAnew, HA>
 <SPI, HA, FAnew>

But what happens, if there exists already another key with the
same SPI between the two enitities FAnew and HA?

Do you think it is desiable to add some clarification about 
this issue of "uniquely identifying SAs and handing them over
from one foreign agent to another" to the internet draft?

All suggestions are welcome, with best regards,

Guenter Schaefer

------------------------------------------------------------------------
Guenter Schaefer, Institute of Telecommunication Systems,
Technical University of Berlin, Einsteinufer 25, 10587 Berlin, Germany, 
Phone: +49 30 314 23836, Fax: - 23818, Email: [email-masked]