Re: [HOKEY] WGLC: draft-ietf-hokey-preauth-ps-02

[<Preetida.Vinayakray-Jani at nokia.com>]

Hi Yoshi:

Thanks for response. Inline pl 

Regds
Preeti
>> >AD. The draft does not make any assumption regarding 
>pre-established  
>> >SA between SA and CA, as SA (Serving Authenticator) acts 
>like a proxy 
>> >and forwards the packets to CA (Candidate Authenticator). 
>MN does not 
>> >directly communicate with CA, but SA does communicate with 
>CA in case 
>> >of indirect pre-authentication. So the role of CA and SA are little 
>> >different than PAR and NAR that you have mentioned for FMIPv6.
>> >
>> >I do not understand quite well about the partial pre-authentication 
>> >of MN. Could you please clarify it little more?
>> >
>> 
>> [Preeti] Parital authentication -> In above scenrio, 
>Preauthentication 
>> involves direct IP level communication between SA and CA, Although 
>> resulted pre-authentication is for MN, it does not include 
>MN's layer 
>> 2 authentication. Hence it is partial. If layer 2 
>authentication fails 
>> then success of layer 3 may not bring any value or 
>underutilization of 
>> reserved resources.
>
>Direct pre-authentication and indirect pre-authentication are 
>the same in that both happen before MN performs L2 secure 
>association to CA.
>Context Binding, described in Section 5.2, will create binding 
>between link-layer independent context and link-layer specific 
>context, so that L2 secure association can succeed when L2 
>handover happens.

[Preeti] I.e. context bidning is carrying link specific or independent
authentication pareamters. However what I mean by partial authentication
is that with proper context binding perhaps L3 authentication can be
successful, but one can only be sure about such successful
authentication if L2 authetnication is also successful. Do you agree? 


>
>Yoshihiro Ohba
>
>
_______________________________________________
HOKEY mailing list
HOKEY at ietf.org
https://www.ietf.org/mailman/listinfo/hokey