Subject: [AAA-WG]: [issue] More Minor corrections/clarifications to draft-mobileip-08

From: "Bob Kopacz" <[email-masked]>
Date: Mon, 25 Feb 2002 11:55:27 -0500

Issue :         More Minor corrections/clarifications to draft-mobileip-08 
Submitter name: Bob Kopacz 
Submitter email address: [email-masked] 
Date first submitted: 02-25-2002 
Reference: 
Document:       mobile-ip 08 
Comment type:   Editorial 
Priority: 1 
Section: 
Rationale/Explanation of issue: 

  Minor corrections/clarifications. 

Requested change: 

In Section 1 "INTRODUCTION"

>   An AAA Home server (AAAH) and AAA foreign server (AAAF) which
>   supports the Mobile-IP authentication application MAY maintain
>   session-state or MAY be session-stateless. AAA redirect agents and
>   AAA relay agents MUST not maintain session-state. AAAH, AAAF, proxies
>   and relays agents MUST maintain transaction state.

Change the beginning of the last sentence from "AAAH..." to "The
AAAH...".

- - - - - 

In Section 1.4 "Allocation of Home Agent in Foreign Network"

Since the AAAF has to send an HAA whether the HA's Result-Code is
success or not:

Replace

>   Upon receipt of a HAA from the Home Agent in the visited realm, with
>   the Result-Code AVP indicating success, the AAAF forwards the HAA to
>   the AAAH in the home realm. The AMA is then constructed, and issued
>   to the AAAF, and finally to the FA. The HAA and AMA MUST include the
>   MIP-Home-Agent-Address and the MIP-Mobile-Node-Address AVPs.

With:

    Upon receipt of a HAA from the Home Agent in the visited realm, the
    AAAF forwards the HAA to the AAAH in the home realm. The AMA is then
    constructed, and issued to the AAAF, and finally to the FA. If the
    Result-Code indicates success, the HAA and AMA MUST include the
    MIP-Home-Agent-Address and the MIP-Mobile-Node-Address AVPs.

Similarly, replace:

>   When the AAAF receives a successful HAA, the AAAF will forward the
>   HAA back to the AAAH. The HAA MUST include the MIP-Home-Agent-Address
>   and the MIP-Mobile-Node-Address AVPs. The AAAH will then send back an
>   AMA to the AAAF in foreign network 2.

With:

    When the AAAF receives a HAA, the AAAF will forward the HAA back to
    the AAAH.  If successful, the HAA MUST include the
    MIP-Home-Agent-Address and the MIP-Mobile-Node-Address AVPs. The AAAH
    will then send back an AMA to the AAAF in foreign network 2.

In the final paragraph of this section:

>   If the old Foreign Network does not permit the use of its Home Agent
>   when the Mobile Node moves to a new foreign network, the AAAH or AAAF
>   MUST return an AMA with the Result-Code AVP set to
>   DIAMETER_ERROR_HA_NOT_AVAILABLE. Upon receipt of this error, the
>   Foreign Agent MUST issue a Mobile IP Registration Reply to the Mobile
>   Node with an appropriate error. The Mobile Node MAY attempt to
>   request that a new Home Agent and Address be allocated. When the AAAH
>   transmits such an error, it MUST issue a Diameter Abort-Session-
>   Request message to the AAAF overseeing the Home Agent to enable it to
                           ^^^^^^^^^^^^^^^

Remove "AAAF overseeing".  I think the ASR goes to the Home Agent. 
I'm not sure the AAAH even has the AAAF's DiameterIdentity to target
the ASR there.

>   release any resources.

- - - - - 

In section 5.1 "Key Material vs. Session Key"

>   The AAAH then generates the session key which is destined for the
>   mobility agent, in this case the foreign agent, by following the
>   above procedures.  It is important that the hashing algorithm used by
>   the mobile node is the same as the one used by the AAAH in the
>   session key generation procedure.  Therefore, the AAAH MUST know a
>   priori the transform used, which is typically contained in the mobile
>   node's configuration profile. 

Remove the  last two sentences, which begin "It is important..." and
"Therefore...".  I think this is outdated baggage.  The AAAH indicates
the algorithm used and the SPI in the Key AVPs which contain key
material, so the a priori stuff goes away.  Or if you don't want to
remove them, then replace them with

"It is important that the hashing algorithm used by the mobile node to
construct the session key is the same as the one used by the AAAH in
the session key generation procedure.  The AAAH therefore indicates
the transform used along with the key material."

>                                 The session keys destined for mobility
>   agents are encoded using the security association available between

Change "are encoded" to "may be encoded".  The other places in the
draft indicate that hiding the keys is a SHOULD or MAY.

>   the AAA server and the agents (e.g. IPSec, TLS, CMS).
>   The Foreign-Home session key is shared between two mobility agents:
>   the FA and HA. Since this key is not destined for the mobile node,
>   there is no need to follow the session key generation procedures
>   detailed above. Instead, the AAAH generates a random [18] value of at
>   least 64 bits for use as the Foreign-Home session key.

- - - - - 

In section 5.2 "Distributing the Mobile-Home Session Key"

Since the HAR still contains the HA's identity as the Destination-Host,
Replace:

>   If, on the other hand, the home agent is to be allocated in the
>   visited realm, the AAAH does not transmit the HAR to the home agent,
>   but instead transmits the HAR to the AAAF. 

With:

"If, on the other hand, the home agent is to be allocated in the
visited realm, the AAAH transmits the HAR to the foreign home agent,
where, prior to delivery to the home agent, it is perused by the AAAF
hosting the home agent."

- - - - - 

In section 6.11 "MIP-FA-to-HA-SPI AVP"

>   The MIP-FA-to-HA-SPI AVP (AVP Code 318) is of type Unsigned32, and
>   contains the Security Parameter Index the Foreign Agent is to use to
>   refer to the session key it shares with the Home Agent. The SPI
>   created MUST NOT be a value between zero (0) and 255, which is the
>   reserved namespace defined in [4]. This AVP MAY be added in the HAA
>   message by the Home Agent for the AAAH's use in MIP-FA-to-HA-SPI AVP
>   of the MIP-FA-to-HA-Key AVP.

Replace the last sentence by:

"If FA-HA keys are being generated, this AVP MUST be added in the HAA
message by the Home Agent for the AAAH's (or AAAF's) use in providing
the value of the MIP-FA-to-HA-SPI member of the grouped
MIP-FA-to-HA-Key AVP."

- - - - -

---

From: Tony Johansson <[email-masked]>
Date: Tue, 26 Feb 2002 21:38:50 -0800

All,

 I will go ahead and add these editorial correction / clarifications.

Comments / objections.

Regards,

/Tony