jouni.korhonen@teliasonera.com wrote:
> Hi,
> 
> I was reading RFC 4004 (again). Both  MIP-HA-to-MN-SPI and
> MIP-MN-to-HA-SPI are listed in respective command ABNFs as mandatory
> AVPs & in AVP occurrence tables; see sections 9.4., 9.6., and 11.1.
> However, no code values have been allocated and no types has been
> defined. Any particular reason for this or am I missing something?    
> 
> Cheers,
> 	Jouni

Hi, Jouni,

As this is the 3rd time this question has come up on the list,
I went back and closely re-read the spec regarding key distribution.
I think I've found a number of errors that need to be corrected.
I hope we can develop an errata in the near future that addresses
these things.

1. We left out the AAA-SPI needed for RFC 3957.

In Section 8.2:

   The hashing algorithm used by the mobile node to construct the
   session key has to be the same as that used by the AAAH in the
   session key generation procedure.  The AAAH therefore indicates the
   algorithm used along with the nonce.
Should be:
   The hashing algorithm used by the mobile node to construct the
   session key has to be the same as that used by the AAAH in the
   session key generation procedure.  The AAAH therefore indicates the
   algorithm used along with the nonce by including a AAA SPI.

In Section 9:

Need to add a new AVP to the table called "MIP-AAA-SPI" of type
"Unsigned32".

In Section 9.5.  MIP-MN-to-FA-MSA AVP

Need to include "{MIP-AAA-SPI}" right before the "{MIP-Nonce}"

In Section 9.6   MIP-MN-to-HA-MSA AVP

Need to include "{MIP-AAA-SPI}" right before the "{MIP-Nonce}"

Create new section 9.15 describing the AAA-SPI:

9.15.  MIP-AAA-SPI AVP

   The MIP-AAA-SPI AVP (AVP Code TBD) is of type Unsigned32 and
   contains the Security Parameter Index the AAA and MN use to 
   indicate the algorithm used to generate a Mobile IP Session Key
   from a Mobile IP Nonce.  It appears in registration replies
   according to [RFC3957].



2. The MN-FA SPI is created by the FA but is currently not being
   transferred in the AMR.  This is needed by the HA to construct
   the Registration Reply that contains the Generalized MN-FA Key
   Generation Nonce Reply Extension.

Section 5.1  AA-Mobile-Node-Request

Need to include "[ MIP-MN-to-FA-SPI "] right after "[ MIP-HA-to-FA-SPI
]"
in the grammar for AMR.

Section 8.4  Distributing the Mobile-Foreign Session Key

   The HA also includes the SPIs proposed by the mobile
   node and foreign agent in the "Generalized MN-FA Key Generation Nonce
   Request" extension.
Should be:
   The HA also includes the SPI proposed by the FA
   in the "Generalized MN-FA Key Generation Nonce
   Reply" extension.


Note that the MIP-MN-to-FA-SPI is correctly included in 
the MIP-MN-to-FA-MSA that is carried in the HAR and defined 
in Section 9.5.  This attribute, however, needs to be added
to the table in Section 9:

Insert "MIP-MN-to-FA-SPI" right after "MIP-HA-to-FA-SPI" in
this table.

Need to add a new Section 9.16:

9.16.  MIP-MN-to-FA-SPI AVP

   The MIP-MN-to-FA-SPI AVP (AVP Code TBD) is of type Unsigned32 and
   contains the Security Parameter Index the MN and FA use to refer to
   the MN-FA mobility security association.  The FA allocates the SPI,
   and it MUST NOT have a value between zero (0) and 255, which is the
   reserved namespace defined in [MOBILEIP].



3. MN-HA SPI is not needed in the MN-HA MSA AVP.  This AVP is sent
   to the HA, and the HA is the one that must choose the SPI.  Therefore
   the SPI is not even available to send from the AAAH to the HA.
   Also, the text incorrectly states that the MN-HA-MSA AVP is carried
   in an AMR, when it should be AMA:

In Section 9.6: 

   This AVP is conveyed to the HA in an
   HAR message for FA COA Mobile IPv4 and in an AMR for collocated
   Mobile IPv4.  The HA allocates the MIP-MN-to-HA-SPI.  The MN creates
   the MN-FA authentication extension using the session key and
   algorithm, and the HA verifies that extension using the same session
   key and algorithm.
Should be:
   This AVP is conveyed to the HA in an
   HAR message for FA COA Mobile IPv4 and in an AMA for collocated
   Mobile IPv4.  The HA allocates the MIP-MN-to-HA-SPI.  The MN creates
   the MN-HA session key using the nonce and
   an algorithm indexed by the AAA SPI.

Delete the line { MIP-MN-HA-SPI } from the ABNF.


4. The HA-MN SPI is not needed in the HA-MN MSA AVP.  This is because
   the HA-MN SPI (chosen by the MN) is already present in the
Registration
   Request that gets sent to the HA.

Delete the line  { MIP-HA-to-MN-SPI   } from the ABNF in Section 9.4.


5. For consistency, we should change the text in Section 9.5 to match
what
   I proposed above for Section 9.6:

   The MN creates
   the MN-FA authentication extension by using the session key and
   algorithm, and the FA verifies that extension using the same key and
   algorithm.
Should be:
   The MN creates
   the MN-FA session key by using the nonce and an algorithm indexed
   by the AAA SPI.


-Pete

_______________________________________________
DiME mailing list
DiME@ietf.org
https://www1.ietf.org/mailman/listinfo/dime