Subject: Review of draft-ietf-nextext-radius-pmip6

From: Bernard Aboba <[email-masked]>
Date: Tue, 10 Jan 2012 10:37:37 -0800

The document appears to contain typos in sections 4.16 and 4.17.   

In section 4.16, it appears that "Home LMA IPv6 address" should be replaced by "Home DHCPv6 server address":

4.16.  PMIP6-Home-DHCP6-Server-Address

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      |  Home DHCPv6 server address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                     Home DHCPv6 server address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                     Home DHCPv6 server address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                     Home DHCPv6 server address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
        Home LMA IPv6 address      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

In Section 4.17, it appears that "Visited LMA IPv6 address" should be replaced by "Visited DHCPv6 server address":

4.17.  PMIP6-Visited-DHCP6-Server-Address

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |   Length      | Visited DHCPv6 server address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                    Visited DHCPv6 server address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                    Visited DHCPv6 server address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                    Visited DHCPv6 server address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      Visited LMA IPv6 address     |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

5.2.  Table of Attributes

   The following table provides a guide to attributes that may be found
   in authentication and authorization RADIUS messages between MAG and
   the AAA Server.

Request Accept Reject Challenge #  Attribute

   0-1     0-1    0-1    0-1      80  Message-Authenticator

[BA] The Message-Authenticator attribute is mandatory-to-implement in a number of 
RADIUS usages, including EAP (RFC 3579).  Leaving out Message-Authenticator could 
result in Access-Requests lacking authentication and
integrity protection.  RFC 6158 Section 3.1 states:

   While [RFC2865] did not require authentication and integrity
   protection of RADIUS Access-Request packets, subsequent
   authentication mechanism specifications, such as RADIUS/EAP [RFC3579]
   and Digest Authentication [RFC5090], have mandated authentication and
   integrity protection for certain RADIUS packets.  [RFC5080], Section
   2.1.1 makes this behavior RECOMMENDED for all Access-Request packets,
   including Access-Request packets performing authorization checks.  It
   is expected that specifications for new RADIUS authentication
   mechanisms will continue this practice.

---

From: jouni korhonen <[email-masked]>
Date: Wed, 11 Jan 2012 08:30:37 +0200

Bernard,

Thank you for your review. See my comments inline.

> In section 4.16, it appears that "Home LMA IPv6 address" should be replaced by "Home DHCPv6 server address":

Blimey.. we'll fix this.

> 4.16.  PMIP6-Home-DHCP6-Server-Address

And the same here..

> 4.17.  PMIP6-Visited-DHCP6-Server-Address

Good point. So, you are saying that we should have:

   1       0-1    0-1    0-1      80  Message-Authenticator

or would 

   1       1      1      1        80  Message-Authenticator

be even better as RFC3759 & 5090 do?

- Jouni

> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 10 Jan 2012 23:04:18 -0800

Message-Authenticator should be mandatory (1 1 1 1).

---

From: jouni korhonen <[email-masked]>
Date: Wed, 11 Jan 2012 09:11:47 +0200

> Message-Authenticator should be mandatory (1 1 1 1).

Ack. Thanks Bernard.

- Jouni