Subject: RE: [mobile-ip] Unresolved issue #7: MH format

From: "Karen E Nielsen (TED)" <[email-masked]>
Date: Thu, 2 May 2002 09:50:44 +0200

Hi Jari,

> Question: Are these formats good?
> 
> Proposal: See formats below.
> 
> Text:
> 
> MH: (8n)
> 
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |Payload Proto  |  Header Len   |            MH Type            |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |           Checksum            |                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
>      |                                                               |
>      .                                                               .
>      .                       Message Data                            .
>      .                                                               .
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> 
> BU: (8n)
> 
>                                      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>                                      |A|H|S|D|      Reserved         |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |          Sequence #           |          Reserved             |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                            Lifetime                           |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      +                                                               +
>      |                                                               |
>      +                           Home Address                        +
>      |                                                               |
>      +                                                               +
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>      |                                                               |
>      .                                                               .
>      .                         Mobility options                      .
>      .                                                               .
>      |                                                               |
>      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> 
>      (This would typically have a Nonce Indices and an Authorization
>      Data mobility options following it. Nonce Indices can go in
>      right after home address since it is 2n. It is 6 bytes long, so
>      the alignment after that is 8n+6, which enables us to fit in
>      Authorization Data immediately (4n+2).
> 
>      It may or may not be necessary to add a Mobile cookie in this
>      message. The alternative is to rely on Sequence #.)

It is still not really clear to me why you need the HoA inside the BU ?!

In BU's sent to HA protected by IPSEC, the HoA needs to be present in the HAO anyway,
and then couldn't the IPSEC SA check authenticate the HoA ? 

In BU's sent to HA protected by some other means, e.g., some authentication data, couldn't
the HoA still be placed in a HAO and then be authenticated via the BU validation ?

The same goes for BU's sent to a CN as the result of an RR exchange  
couldn't the HoA be placed in the HAO and be authenticated via the BU validation ?

Wrt the latter (RR BU's), I am not really up to date, if this is totally out of line with the
RR mechs then please ignore.

Karen

---

From: Francis Dupont <[email-masked]>
Date: Thu, 02 May 2002 10:29:14 +0200

=> in order to protect it in any case.

   In BU's sent to HA protected by IPSEC, the HoA needs to be present
   in the HAO anyway, and then couldn't the IPSEC SA check authenticate
   the HoA ?
   
=> this is *not* true: if the IPsec transform is not AH, the HAO is not
covered by the integrity check and it is authenticated only by the SA
lookup (i.e. not by the crypto, only by (reusing Mike Thomas' words)
an access-list mechanism).

   In BU's sent to HA protected by some other means, e.g., some
   authentication data, couldn't the HoA still be placed in a HAO and
   then be authenticated via the BU validation ?
   [...]

=> same answer: to put the HA in the BU just makes things simpler
(and security things must be simple in order to be secure).   
Another argument is to make the BU self-sufficient ables non-standard
way to transport the BU (piggy-backing into an AAA AVP for instance).
   
Regards

[email-masked]

---

From: Michael Thomas <[email-masked]>
Date: Thu, 2 May 2002 06:54:43 -0700 (PDT)

> an access-list mechanism).

Thanks for remembering that, Francis. I had forgot!
 
 > way to transport the BU (piggy-backing into an AAA AVP for instance).

Yes, that's what I was also thinking.
Self-contained seems a lot cleaner. Also, maybe we
can turn this around: if you put the home address
in the BU, is there a reason to require a HAO at
all? I'm not saying make *il*legal, but just not
a requirement for a naked BU.

	   Mike