Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related) (ISSUE 5)

From: "Jayshree Bharatia" <[email-masked]>
Date: Sat, 9 Nov 2002 12:44:31 -0600

Issue 5:
Section 3.2: "attempting to replay a previous advertisement and
authentication.  If the challenge extension is needed and does not exist,
the Foreign" What does "needed" mean here? That the FA has a policy knob
whether or not it is needed? Or something else?
 
Proposal:
I am proposing the following text to resolve the above issue. 
 
Existing Text (section 3.2)
Upon receipt of the Registration Request, if the Foreign Agent has issued a
Challenge as part of its Agent Advertisements, and it does not have a
security association with the mobile node, then the Foreign Agent SHOULD
check that the Mobile-Foreign Challenge extension exists, and that it
contains a challenge value previously unused by the Mobile Node. This
ensures that the mobile node is not attempting to replay a previous
advertisement and authentication. If the challenge extension is needed and
does not exist, the Foreign Agent MUST send a Registration Reply to the
mobile node with the Code value MISSING_CHALLENGE.
 
New Text (section 3.2)
Upon receipt of the Registration Request, if the Foreign Agent has issued a
Challenge as part of its Agent Advertisements, and it does not have a
security association with the mobile node, then the Foreign Agent MUST check
that the Mobile-Foreign Challenge extension exists, and that it contains a
challenge value previously unused by the Mobile Node. This ensures that the
mobile node is not attempting to replay a previous advertisement and
authentication. In this case, if the Registration Request does not include a
challenge extension, the Foreign Agent MUST send a Registration Reply to the
mobile node with the Code value MISSING_CHALLENGE.
 
Any Comment?
 
Thanks,
Jayshree

-----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Thursday, September 26, 2002 10:13 AM
To: [email-masked]'; [email-masked]
Cc: 'Charlie Perkins'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related)
(ISSUE 5)

Please se comments inline. 

Regards; 
Ahmad Muhanna 

Non-editorial comments associated with RFC3012bis: 

Please post your comments with the appropriate issue number in the subject
line (instead of simply replying to this email).

-Chairs. 

5. Section 3.2 
   "attempting to replay a previous advertisement and authentication.  If 
   the challenge extension is needed and does not exist, the Foreign" 
   What does "needed" mean here? That the FA has a policy knob whether 
   or not it is needed? Or something else? 

Yes, let us read the whole paragraph as in section 3.2. to understand the
policy: 

"   Upon receipt of the Registration Request, if the Foreign Agent has 
   issued a Challenge as part of its Agent Advertisements, and it 
   does not have a security association with the mobile node, then 
   the Foreign Agent SHOULD check that the Mobile-Foreign Challenge 
   extension exists, and that it contains a challenge value previously 
   unused by the Mobile Node.  This ensures that the mobile node is not 
   attempting to replay a previous advertisement and authentication.  If 
   the challenge extension is needed and does not exist, the Foreign 
   Agent MUST send a Registration Reply to the mobile node with the Code 
   value MISSING_CHALLENGE. 
" 

Restrictions, or conditions, or Policy: 
1. If the FA has issued a Challenge, in other words, it supports the MN-FA
Challenge, 
2. If the FA does not have a security association with the MN, 
3. If the FA receives a RRQ from this MN, 

The Foreign Agent SHOULD check the presence of MN-FA Challenge extension. 
However, I suggest changing this to a "MUST". 

Because, this "MUST" is applicable ONLY with the above three conditions. 
" No problem with the FA backward compatibility nor with Forward
compatibility 
related to dynamically establishing a SA between the MN and the FA"  

Also, to be consistent with the restrictions on the MN, that it 
MUST include MN-FA Challenge extension when it does not have a 
security association with the FA. 

Regards, 
Ahmad

---

From: "Jayshree Bharatia" <[email-masked]>
Date: Thu, 14 Nov 2002 12:06:55 -0600

Hello all,
 
The proposed new text is mandating all Mobile Nodes to send challenge
extension in registrations. This will not work with the Mobile Node which is
just RFC3344 compliant. Hence I like to change the text to:
 
Upon receipt of the Registration Request, if the Foreign Agent has issued a
Challenge as part of its Agent Advertisements, and it does not have a
security association with the mobile node, then the Foreign Agent SHOULD
check that the Mobile-Foreign Challenge extension exists, and that it
contains a challenge value previously unused by the Mobile Node. This
ensures that the mobile node is not attempting to replay a previous
advertisement and authentication. In this case, if the Registration Request
does not include a challenge extension, the Foreign Agent MUST send a
Registration Reply to the mobile node with the Code value MISSING_CHALLENGE.
 
The error code MISSING_CHALLENGE is also questionable for the reason
mentioned above. Hence, the Foreign Agent basically needs to accept the
Registration Request without the Challenge extension from the RFC 3344
compliant Mobile Node (which doesn't support Challenge extension).
 
Any Comments?
 
Thanks,
Jayshree
 
 -----Original Message-----
From: Bharatia, Jayshree [RICH1:2H13:EXCH] 
Sent: Saturday, November 09, 2002 12:45 PM
To: [email-masked]
Cc: 'Charlie Perkins'; Muhanna, Ahmad [RICH2:2Q20:EXCH];
[email-masked]'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related)
(ISSUE 5)

Issue 5:
 
Proposal:

New Text (section 3.2)
 
Any Comment?
 
Thanks,
Jayshree

-----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Thursday, September 26, 2002 10:13 AM
To: [email-masked]'; [email-masked]
Cc: 'Charlie Perkins'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related)
(ISSUE 5)

Regards; 
Ahmad Muhanna 

-Chairs. 

5. Section 3.2 

Regards, 
Ahmad