Subject: [mobile-ip] Mobile IPv6 clarifications

From: Mattias Pettersson <[email-masked]>
Date: Mon, 18 Jun 2001 11:04:59 +0200

Hi all,

We've been playing aroung with MIPv6 for a while and came up with these
considerations:

1. Let's say the MN is away and is registered with the HA, and then the
MN either
  A) reboots/crashes (unintentional)
  B) is shut off (intentional)
for some reason. In A), it has no way of de-registering with the HA
before the crash. In B) I don't think you have the possibility anyway
according to the spec, since the MN isn't at home. Some might say that
the MN should store state on non-volatile memory, but can all platforms
support that?
 
Anyway, the MN comes up again and tries to register with the HA. The
binding in the HA is still valid for the remaining lifetime based on
  - Home prefix lifetime
  - Care-of prefix lifetime
  - MN policy
  - HA policy

and can be anything from seconds to weeks.

The HA has an associated sequence number S with the binding, and S >= 0.
A fresh registration from the MN would use sequence number 0. So MN
sends a BU with seq no T = 0. The HA compares it with S, and silently
ignores the BU if the T <= S. After timeout (1 second at first), the MN
re-transmits the BU, now with T increased. It can be increased with any
value D, please see below.

MN will keep retransmitting the BU with exponential backoff for the
interval. Finally T > S, and the HA will accept the registration. How
long time this will take and how many BUs it will require of course
depends on S and D.

Let's set D=1. If S is large, it will take very long time for MN to
register. It is likely that the binding expires, rather than T reaches
S.

If D is large, say 8192 which is 1/8th of the total sequence number
space (16 bit), we could reach S after max 8 transmitted BUs (but also
see next question). On the other hand, that will quickly consume large
parts of the sequence number space.

Our suggestion is that we instead define a new BA status code (139?) of
"sequence number too small". If the HA recieves a BU where T <= S, it
must instead send a BA back to MN with status = 139 and the sequence
number field set to S. The MN will retransmit the BU and now use T = S +
D (D=1 comes to mind as best choice).

Does anyone see a security problem here? The HA only exposes what has
already been transmitted over the wire. The HA doesn't need to keep
state for this.

2. There should be a statement about sequence numbers. According to the
sequence number comparison method, the number 0 is smaller than 1 up to
32767, but greater than 32768 up to 65535. If MN sends a BU with
sequence number 0 at some point, it can use all sequence numbers up to
32767. After that, it must renegotiate SA with the peer (HA/CN), or it
will be exposed to a potential replay attack.

/Mattias and Ulf