Subject: Re: [AAA-WG]: Re: Proposed Text for Issue 91 (KDC)

From: Joe Lau <[email-masked]>
Date: Mon, 23 Jul 2001 13:19:27 -0700 (PDT)

Hi Pat,

With MIP-MN-to-HA-Key defined as a grouped AVP instead of the previous
Generalized Key Reply Extension with Unsolicited MN-FA Key Material subtype,

	  MIP-MN-to-FA-Key ::== <AVP Header: 325 >
                                { MIP-Algorithm-Type }
                                { MIP-Session-Key }
                              * [ AVP]

how can the HA figure out the "AAA SPI" field in order to create the
Generalized Key Reply Extension with Unsolicited MN-FA Key Material subtype
in the Registration Reply to the MN.

Also, am I right that AAA SPI refers to algorithm like CHAP-SPI?  What
are the other possible algorithms?

Thank you for the clarification and info.

Joe

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 23 Jul 2001 15:01:49 -0700

> in the Registration Reply to the MN.

Ah, I see the problem. Yes, this Grouped AVP does need to include the
AAA SPI, which the HA includes in the MIP key extension.

Another issue that needs to be resolved as part of last call comments.

Thanks,

PatC

> are the other possible algorithms?

No, the SPI refers to an encryption transform. Similar to MIP autentication
extensions, both sides have an SPI that points to the auth transform used 
in the authenticator computation, the AAA SPI will point to the transform
used to encrypt/decrypt the session keys.

Hope this helps,

PatC