Subject: RE: [mobile-ip] Unresolved issue #3: BA, BR authentication?

From: "Tuomas Aura" <[email-masked]>
Date: Wed, 8 May 2002 04:53:25 -0700

> I dont agree that engineers would be fooled as you describe. I think
> they are much smarter!!. Having the MAC_Kbu with the BA would
eliminate
> the need for random initialization for the sequence number. It can be
> as it used to be. I would appreciate it, if the sequence number is
left
> as it is now.

I'm not sure that we engineers are so smart.
The fact that K_bu in the current protocol can be used for 
BA authentication was simply an accident. It did not happen
by design. I was very much surprised when I realized that 
the cookie exchanges in CoT/CoTI/Hot/HoTI give K_bu this 
property.

I do not want to use K_bu for BA authentication for two 
reasons:
(1) As say before, it is difficult to understand how 
    and why it works. 
(2) It is fragile. Any change to the way the protocol is 
    used might break the BA authentication. For example,
    what happens if the cookies in CoT/CoTI  or Hot/HoTI 
    are reused or if the cookie in HoT/HoTI is replaced with
    a key established in some other way?
    (I could not answer this without taking another look.)

I do believe that using K_bu for BA authentication in the 
current, full, and unchanged protocol does give small 
theoretical security advantage. (My colleague Ernie Cohen even 
verified this formally.) Nevertheless, for the two reasons 
listed above, I think using K_bu for BA authentication is a 
bad idea. 

Tuomas

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 08 May 2002 10:20:13 -0700

> (1) As say before, it is difficult to understand how

Again, I have no clue why you say this.

>     (I could not answer this without taking another look.)

Tuomas, A key is needed for protecting the BU and BA. That is
Kbu. Once we have the key, it is simple calculating MAC over
the BU and the BA. 

Now, Lets see how Kbu is obtained.

1. A complete HoTI/HoT and CoTI/CoT exchange.

2. A reused home cookie and CoTI/CoT exchange.

3. A static key between the MN and a known CN.

4. Some other scheme.

So, why is this fragile???

Do you realise that the CN and MN already have the Kbu, and
they dont have to do anything extra for additional protection
for the BA?

> listed above, I think using K_bu for BA authentication is a

Sorry, I dont buy your two reasons. 

A couple of points I guess we agree on.

1. The protection for BA is not as strong as protection for BU 
in the RR procedure.

2. The Kbu used on BA gives some additional protection 
(irrespective of how Kbu is obtained). Kbu by itself does not
provide protection. It is in addition to the sequence number
in the BA.

Vijay