Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related) (ISSUE 13)

From: "Jayshree Bharatia" <[email-masked]>
Date: Sat, 9 Nov 2002 13:57:30 -0600

Issue 13: Section 8-The concatenation of fields for MD5 include "length" and
"SPI" but it isn't clear to me how many bits of length and SPI are fed in
since these two fields are not fields in the protocol itself as I understand
it
 
Proposal:
As Ahmad mentioned in the following email, it is already clarified in the
extension format of RFC3012bis that the "length" is 2 bytes and the "SPI"
field is 4 bytes long.
 
Any comments?
 
Thanks,
Jayshree

-----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Thursday, September 26, 2002 11:19 AM
To: [email-masked]'; [email-masked]
Cc: 'Charlie Perkins'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related)
(ISSUE 13)

please see comments inline. 

Regards; 
Ahmad Muhanna 

Non-editorial comments associated with RFC3012bis: 

Please post your comments with the appropriate issue number in the subject
line (instead of simply replying to this email).

-Chairs. 

13. Section 8 
    The concatentation of fields for MD5 include "length" and "SPI" 
    but it isn't clear to me how many bits of length and SPI are fed 
    in since these two fields are not fields in the protocol itself as 
    I understand it. 

If we read the whole thing it becomes clearer. 
" 

   To compute the authenticator, apply MD5 [10] computed on the 
   following data, in the order shown: 

      High-order byte from Challenge || Key || 
      MD5(Preceding Mobile IP data || 
      Type, Subtype (if present), Length, SPI) || 
      Least-order 237 bytes from Challenge 

   where the Type, Length, SPI, and possibly Subtype, are the fields 
   of the authentication extension in use.  
" 

These are the fields of the authentication extension specified in section 5.

" 
       0                   1                   2                   3 
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
      |     Type      |    Subtype    |            Length             | 
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
      |                              SPI                              | 
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
      |                         Authenticator ... 
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 

      Figure 3: The Generalized Mobile IP Authentication Extension 

      Type            36 (not skippable) (see [7]) 

      Subtype         a number assigned to identify the kind of 
                      endpoints or the other characteristics of the 
                      particular authentication strategy 

      Length          4 plus the number of bytes in the Authenticator; 
                      MUST be at least 20. 

      SPI             Security Parameters Index 

      Authenticator   The variable length Authenticator field 

   In this document, only one subtype is defined: 

      1               Mobile-AAA Authentication subtype (see section 6) 
" 

This tells us that the length field is two bytes. The SPI field is 4 bytes. 

Regards, 
Ahmad