Subject: RE: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt

From: "Jayshree Bharatia" <[email-masked]>
Date: Wed, 23 Nov 2005 08:43:49 -0600

Vijay,

My understanding of the proposal is that challenge value 0 will be used
for the calculation for co-located CoA mode. Hence, there won't be
challenge extension included in the registration request. I haven't
included your suggestion on using timestamp for replay protection.
Please propose new text for this change and I will include it in the
document. 

Regards,
Jayshree
-----Original Message-----
From: Vijay Devarapallli [mailto:[email-masked]] 
Sent: Tuesday, November 22, 2005 8:42 PM
To: Henrik Levkowetz
Cc: Bharatia, Jayshree [RICH1:2H13:EXCH]; Kent Leung (kleung); Nakhjiri
Madjid-MNAKHJI1; Pete McCann; [email-masked]; [email-masked]
Subject: Re: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt

On 11/22/05, Henrik Levkowetz <[email-masked]> wrote:
> Hi Jayshree,
>
> I believe we've reached consensus on this.  The AD is waiting for an 
> updated document, so please make the change and submit a new version.

just to make sure I understand what the consensus is.

when Kent and I discussed this, we agreed that the MN leaves out the
challenge extension in the registration request when using co-located
CoA mode rather than include a null challenge.

is this the consensus?

I think we also need some text which explains that replay protection is
provided by the use of timestamp in the registration request instead of
a challenge when the mobile node is using co-located CoA mode.

Vijay

>
> Regards,
>
>         Henrik
>
> on 2005-11-08 17:55 Jayshree Bharatia said the following:
> > I am also ok with this suggestion. If it is agreed by all, I can 
> > change section 3.1 to reflect this change.
> >
> > Regards,
> > Jayshree
> >
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]] On Behalf

> > Of Kent Leung (kleung)
> > Sent: Monday, November 07, 2005 8:40 PM
> > To: Nakhjiri Madjid-MNAKHJI1; Vijay Devarapallli; Pete McCann
> > Cc: [email-masked]; [email-masked]
> > Subject: RE: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt
> >
> >
> > I agree with this sentiment.  Unless there's an issue with using 
> > zero for Challenge value in the calculation for CCoA mode, this 
> > problem will be addressed in the draft.  The challenge is not needed

> > for CCoA mode since there's already Timestamp/Nonce replay 
> > protection.
> >
> > Kent
> >
> >> -----Original Message-----
> >> From: Nakhjiri Madjid-MNAKHJI1 
> >> [mailto:[email-masked]]
> >> Sent: Monday, November 07, 2005 4:46 PM
> >> To: Kent Leung (kleung); Vijay Devarapallli; Pete McCann
> >> Cc: [email-masked]; [email-masked]
> >> Subject: RE: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt
> >>
> >> The fix to deal with CCoA is a very small one as I mentioned my 
> >> previous email. I really don't think it warrants a huge discussion 
> >> or a doc split. The fix that we suggested was agreed by Charlie as 
> >> well.
> >>
> >> Madjid
> >>
> >>
> >> -----Original Message-----
> >> From: [email-masked] [mailto:[email-masked]] On 
> >> Behalf Of Kent Leung (kleung)
> >> Sent: Monday, November 07, 2005 11:42 AM
> >> To: Vijay Devarapallli; Pete McCann
> >> Cc: [email-masked]; [email-masked]
> >> Subject: RE: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt
> >>
> >> On this particular topic, I don't understand what is missing in the

> >> details to support the CCoA mode?  Since the draft covers MN-AAA 
> >> authentication with NAS in between, I would like to see both FA 
> >> (CoA) and HA (CCoA) modes supported. Where else would we be able to

> >> cover just the CCoA for MN-AAA authentication if not in this draft?
> >>
> >> Kent
> >>
> >>
> >> >
> >> > not at this late stage. its fine as it is. however, I have
> >> one comment
> >>
> >> > on the support for co-located CoA mode. the draft claims it
> >> supports
> >> > it but there really isnt enough detail.
> >> > IMO, it should be clarified that only FA mode is described in the

> >> > draft.
> >> >
> >>
> >> --
> >> Mip4 mailing list: [email-masked]
> >>     Web interface: https://www1.ietf.org/mailman/listinfo/mip4
> >>      Charter page: 
> >> http://www.ietf.org/html.charters/mip4-charter.html
> >> Supplemental site: http://www.mip4.org/
> >>
> >
>

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: Vijay Devarapallli <[email-masked]>
Date: Wed, 23 Nov 2005 14:29:39 -0800

On 11/23/05, Jayshree Bharatia <[email-masked]> wrote:
> challenge extension included in the registration request.

agree.

> I haven't

it wasnt mine. Kent?

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 29 Nov 2005 13:23:50 -0800

Hi Jayshree,

>>Please propose new text for this change and I will include it in the

here are a few suggested changes to make sure 3012bis
describes clearly how the co-located CoA mode works.
please excuse me if some of the suggested changes look
clumsy or if I overlooked something. I was not involved
in 3012 standardization. :)

section 3.1, replace

>    A mobile node MAY include the Mobile-AAA Authentication extension in
>    the Registration Request when the mobile node registers directly with
>    its home agent (using a co-located care-of address).  In this case,
>    if the mobile node uses an SPI value of CHAP_SPI (Section 8) in the
>    MN-AAA Authentication extension, the mobile node MUST include the
>    Mobile-Foreign Challenge extension prior to the Mobile-AAA
>    Authentication extension.  The mechanism used by the mobile node to
>    obtain the Challenge value in this case is outside the scope of this
>    document.

with

    A mobile node MAY include the Mobile-AAA Authentication extension
    in the Registration Request when the mobile node registers directly
    with its home agent (using a co-located care-of address).  In this
    case, the mobile node uses an SPI value of CHAP_SPI (Section 8) in
    the MN-AAA Authentication extension and MUST NOT include the
    Mobile-Foreign Challenge extension.

in section 3.5, at the end of section add the following

    In the co-located CoA mode, the mobile node will receive a
    Registration Reply without the Challenge Extension and processes
    the Registration Reply as specified in [RFC3344].

add a new section before "Generalized Mobile IP
Authentication Extension"

5. Co-located Care-of Address mode

    When a foreign agent is not present, the mobile node uses co-located
    CoA mode to send a Registration Request to the home agent. Since
    there is no foreign agent, there is no mobile IP specific entity in
    the visited network to generate a challenge. Therefore the mobile
    node sends a Registration Request without the Challenge extension.
    Replay protection for the Registration Request is provided by the
    Identification field [RFC3344].

in the Security Considerations sections, include the
following at the end.

    The challenge extension specified in this document cannot be
    used when there is no foreign agent present in the foreign link.
    Replay protection is provided only by the Identification field
    in the Registration Request message.

Vijay