[Dime] HA-to-AAAH draft/support of RFC 4285

["Julien Bournelle" <julien.bournelle at gmail.com>]

Hi all,

as discussed during the DiME WG meeting, we have to support the
RFC4285 in our Diameter Application for mip6.

Let me reexplain briefly the situation:

MN ----------- HA/AAAclient ----------------AAA server

Our application defines the protocol between the AAAclient located in
the HA and the AAA server.

Between, the MN and the HA, we use:

A/ either IKEv2 with EAP to setup IPsec SAs (to protect mip6 signalling).

B/ or RFC 4285 aka Mobile IPv6 Authentication Option (could be compared
to what is used in mip4).

In A/, EAP is used for authentication, our Diameter Application will carry
EAP packets and will deliver specific mip6 AVPs. At the end of the AAA process,
IPsec SAs are setup and the MN can send its mip6 Binding Update.

In B/, the MN has a pre-shared key with the AAA server. It sends its mip6
Binding Update signed using this pre-shared key to the HA. Our
Diameter Application
is then used to perform Authentication by the AAA server (owner of the
pre-shared
key).

So, to sum up, we have two different MN-HA interaction (IKEv2-EAP and RFC4285)
and one Diameter Application between HA and AAA. To solve this, we
have two options
in our Application:

Option 1: we define 2 different commands: one command to deal with EAP and
one command to deal with RFC 4285.

Option 2: we define one command and one generic Authentication AVP.

I'd like to hear your opinion on this.

My personal feeling is that I would prefer Option 1. The reason is
that I think it's cleaner
for the server to know from the command-code the associated
authentication method. More especially when we have EAP type
authentication.

Regards,

Julien

_______________________________________________
DiME mailing list
DiME at ietf.org
https://www1.ietf.org/mailman/listinfo/dime