Subject: [Mip6] Question regarding RFC 4285

From: "Julien Bournelle" <[email-masked]>
Date: Mon, 21 May 2007 17:13:12 +0200

Hi all,

 I read RFC 4285 and I have some clarifications questions.

 From what I understood, if we use the MN-AAA Mobility Message Authentication
option in the BU, the HA have to send a BA with a MN-HA Mobility
Message Authentication
option (see section 5.2).

 Does this mean that even with the use of the MN-AAA option, we
assume that the MN and HA have a pre-shared key ? or that if we do not have
a MN-HA key, the MN does not request a BA ?

  Thanks,

 Julien

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Mon, 21 May 2007 10:42:42 -0500

Hi Julien,

I believe the assumption here is that the MN has a secret key (i.e.
MN-AAA SA) with its HAAA. However, it is also assumed that the MN will
be able to derive a MN-HA session key based on the MN-AAA secret key. In
other words, the MN and its HAAA would have a predefined mechanism to
derive the MN-HA secret key based on the MN-AAA secret + some other
session parameters, e.g. HA IP address, etc.

In other words, the MN is always required to have a mechanism which
allows the MN to validate the BA.

Regards,
Ahmad

> -----Original Message-----
> From: Julien Bournelle [mailto:[email-masked]] 
> Sent: Monday, May 21, 2007 10:13 AM
> To: [email-masked]
> Subject: [Mip6] Question regarding RFC 4285
> 
> Hi all,
> 
>  From what I understood, if we use the MN-AAA Mobility 
> Message Authentication option in the BU, the HA have to send 
> a BA with a MN-HA Mobility Message Authentication option (see 
> section 5.2).
> 
>  Does this mean that even with the use of the MN-AAA option, 
> we assume that the MN and HA have a pre-shared key ? or that 
> if we do not have a MN-HA key, the MN does not request a BA ?
> 
>   Thanks,
> 
>  Julien
>