Subject: Re: [AAA-WG]: Issue 91: MIP SPI

From: Pat Calhoun <[email-masked]>
Date: Tue, 10 Jul 2001 13:42:33 -0700

Finally getting back into things...

On Fri, Jun 29, 2001 at 09:59:12AM +0200, Martin Julien (ECE) wrote:
> The HA would select a SPI for the MN-HA SA and the FA-HA SA.
> The thing is that it is not so easy for the FA to suggest a
> Preferred HA-FA SPI, since it might not know the HA yet, since
> it needs to be allocated by the AAAH. The HA-FA SPI, allocated by the
> HA, could be returned in the HAA, to inform the AAAH about it,
> so that it can include it in the FA-HA Key AVP destined to the FA.
> In that example, there is no need for a Preferred HA-FA SPI, neither
> for a Preferred HA-MN SPI, right?

correct.
> 
> The FA would then be responsible for allocating the SPI of the SA 
> between the FA and the MN. In the AMR, the FA would include the 
> allocated FA-MN SPI for the AAAF to keep the SPI value, in case
> it supports returning an existing set of Session keys a new
> FA, when the MN is roaming. In that example, there is no need for 
> a Preferred MN-FA SPI, right?

ok, but *some* AVP will be required to communicate the SPI value to the
AAAF.

> > ok, so the Diameter draft could state that the AAAH still 
> > inserts an SPI, but
> > the HA is allowed to override that value if it is deemed 
> > necessary. Would this
> > work?
> 
> I think so, but I still do not see the need for the AAAH to be
> involved at all in that allocation, not even in forwarding the
> Preferred-SPI.

what do other folks think??

> > Not sure. I think that the Preferred-SPIs MUST be present for 
> > key request,
> > since the SPIs are present in the MIP Key Request extension, so it is 
> > trivial for an FA to include these values in the Diameter 
> > message. I think
> > that we should mandate that the FA include these values. What 
> > do you think?
> 
> But maybe not the HA-FA SPI, in the case where you do not know the
> HA yet?

correct.

> It depends if you agree with me that the Preferred-SPI AVPs are not required. 
> I think we could use them, but since I don't see them very useful,
> I think it would simplify the protocol to remove them and use an alternative
> solution, which can never be wrong. Maybe you're thinking of something I 
> have not realized yet, though?

Well, The MIP Key extensions allow the mobile to "suggest" an SPI. If this
information cannot be communicated to the AAAH, and the AAA infrastructure
generates SPIs, then we have a problem. If we can agree that SPI allocation
is not the responsibility of the AAAH, then the simplest solution is to
remove the AVPs, and add a little text about returning the SPIs in the HAA.

Others?

PatC