[Mipshop] Re: Review of draft-vidya-mipshop-handover-keys-aaa-00.txt

["James Kempf" <Kempf at docomolabs-usa.com>]

>  We could certainly define a way to provide a key both for MN and AR
>  during the network authentication phase.  EAP provides a way to create
>  key for application (AMSK) (Appendix A of our draft).
>  Thus we need to define a key specific for
>  FMIPv6 and a way for the EAP authenticator to push the keying material
>  to appropriate AR (not defined in the current draft).
>
>  The problem that I can see is after IP handover, how do the MN get a
>  new key ? If we continue to rely on EAP, it will imply a
>  reauthentication from scratch.
>

One of two ways:

1) The MN has actually reauthenticated for network access from scratch in
order to establish its session key with the new AR/AP, and in the process
obtained a handover key. In 802.1x, that is, in fact, currently the only way
I believe, though the 802.11r WG is looking to change this.

2) The MN has performed preauthentication with a collection of AR/APs around
the current one, and so has a key already available.

            jak



_______________________________________________
Mipshop mailing list
Mipshop at ietf.org
https://www1.ietf.org/mailman/listinfo/mipshop