Subject: RE: [mobile-ip] Regional Registration Last Call issue #3: ISSUE

From: "Ahmad Muhanna"<[email-masked]>
Date: Fri, 17 May 2002 10:33:20 -0500

Hello Annika
I just noticed that there is a very serious issue in the replay protection
scheme you are proposing.
Here is the details:

1. Your proposal suggest that MN inform the GFA about the replay protection
it is using
    with its Home Agent using the Replay Protection Extension " 0 Timestamp,
1 nonce"
2. Despite the fact that there is a serious security hole here, BUT let us
assume that
    there is NOT.
3. When GFA receives the Mobile Node Home registration it looks into the
Replay protection
    extension and find out which scheme it needs to use for this Mobile Node
during its regional
    registration.
4. GFA forwards the registration request without the replay protection
extension, since HA knows
    that from the SA with the Mobile Node.
5. Let us assume that the MN (using timestamp) is NOT in sync with its HA.
THEN HA rejects
    the registration request with code 133 and send the registration reply
to the GFA.
6. GFA forwards the registration reply to the MN which uses the registration
reply ID to sync
    itself with its HA.
7. MN sends another Home registration request with the replay protection
extension included.
8. GFA forwards the MN home registration request to the HA which accepts it
and sends registration
    reply message with code 0.
9. GFA updates the MN binding with lifetime, etc.

NOW:
10. MN moves to a new FA and send a regional registration request to GFA.
11. OOPS! MN IS IN SYNC WITH ITS HA not this GFA.
      What the GFA is supposed to do.

Let us remember the GFA and HA belongs to two different vendors who are very
far apart from each other.
That is why we are proposing the regional registration to save Home
Registration Signaling.

Do you suggest that GFA sync itself with the HA, which is apparently
impossible.
Because, GFA serves many different HAs.

OR

MN needs another two round trips registration to sync itself with every GFA
it register with
while away from Home.

Thanks for your consideration.

Regards;
Ahmad Muhanna