Subject: [mobile-ip] Unresolved issue #21: MIN/MAX or one limit for lifetimes?

From: Jari Arkko <[email-masked]>
Date: Sun, 05 May 2002 12:39:50 +0300

Background: As discussed in issue 6, having the cookies be valid for
some amount of time makes it efficient to move around fast. Under issue
6, there was a discussion about the exact times necessary for this. The
discussion centered around MAX_COOKIE_LIFE. However, there is a related
constant MIN_COOKIE_LIFE. It is recommended that correspondent nodes
try to keep these cookies acceptable at least MIN_COOKIE_LIFE seconds
and SHOULD NOT allow them to be accepted beyond MAX_COOKIE_LIFE
seconds.

MAX_COOKIE_LIFE relates to the period of vulnerability. MIN_COOKIE_LIFE
relates to the most certain period under which a mobile node can
reasonably use a cookie -- after the MIN time there is much bigger
likelihood that the correspondent node does not accept the cookie.

(Note: while this discussion is about cookies, the cookies are simply
cryptographic by-products, and the real issue is aging of the nonces
used by the correspondent node. Invalidating a nonce will make the
cookies generated based on it also invalid.)

Question: When should the mobile node stop using a cookie, after the
MIN or the MAX time? Are the times given for MIN and MAX in right
relation to each other (e.g. 60/180 s)? Is the MIN time useful?

Proposal: A mobile node which optimistically relies on a cookie between
its MIN and MAX times is going to fail in this attempt, if the
correspondent node is busy and has already invalidated the cookies.
This will also happen if the correspondent node follows the standard
too literally. However, most correspondent nodes that are not under a
heavy load would likely have memory to keep the cookies alive long
enough. Likewise, it will be impossible to guarantee lifetime even to
MIN under all circumstances, such as reboots. An invalid cookie problem
is also always acknowledged. If an acknowledgement was not required in
the binding update, and the error acknowledgement is lost, some packets
could be lost before the problem is noticed.

In conclusion the specification should allow the cookies to be used
until the MAX time, but require acknowledgements to be used for
"reused" cookies. MIN time is not necessary.

Correspondent nodes may still have to invalidate nonces and cookies, in
particular under situations where BCE entries are rapidly being deleted
and there is not enough memory to store both the deleted entries and
the new ones. Draft 17 will contain text that recommends the oldest
cookies to be invalidated first. If this happens, some Binding Updates
sent by fast moving mobiles may fail. However, we expect this to be
a rare enough event with correctly dimensioned correspondent nodes
that we can deal with it in an optimistic manner.