Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related) (ISSUE 15)

From: "Ahmad Muhanna" <[email-masked]>
Date: Sun, 10 Nov 2002 06:59:45 -0600

Jayshree,

Please see comments inline.
Just a typo and a comment.

Regards; 
Ahmad Muhanna 

-----Original Message-----
From: Bharatia, Jayshree [RICH1:2H13:EXCH] 
Sent: Saturday, November 09, 2002 2:17 PM
To: [email-masked]
Cc: 'Charlie Perkins'; [email-masked]'; Muhanna, Ahmad
[RICH2:2Q20:EXCH]
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related)
(ISSUE 15)

Issue 15: Section 8 (SPI For RADIUS AAA Servers) defines a method of
computing the Generalized Mobile IP Authentication Extension's authenticator
field using MD5 in a manner that is consistent with RADIUS [9].  The use of
MD5 in the method described in Section 8 is less secure than HMAC-MD5 [6],
and should be avoided whenever possible.

Proposal:
As recommended by Ahmad, I have defined a new SPI (HMAC_CHAP_SPI) which will
indicate usage of HMAC-MD5 instead of MD5 in the authenticator. Due to
interoperability issue, it is essential that the usage of this new extension
remain optional. The following change is proposed:

Existing text
(section 3.1 )
If the SPI value is chosen as CHAP_SPI (see section 9), then the mobile node
specifies CHAP-style authentication [11] using MD5 [10].

(section 8)
For instance, all four of  these fields would be in use when SPI == CHAP_SPI
is used with the Generalized Authentication extension.

(Section 9)
Parameter Name                    Default Value   Section(s) of Document
 --------------                           -------------
----------------------
CHALLENGE_WINDOW   2                        3.2
CHAP_SPI                            2                        8    

New text:
(Section 3.1)
If the SPI value is chosen as CHAP_SPI or HMAC_MD5 (see section 9), then the
mobile node specifies CHAP-style authentication [11] using MD5 [10] or
HMAC_MD5, respectively.

<<Ahmad>>
I think you meant it to say MAC_CHAP_SPI instead of HMAC_MD5.
<< Ahmad>>
 
(Section 8)
where the Type, Length, SPI, and possibly Subtype, are the fields of the
authentication extension in use.  For instance, all four of these fields
would be in use when SPI = (CHAP_SPI or HMAC_CHAP_SPI) is used with the
Generalized Authentication extension.

However, SPI number HMAC_CHAP_SPI indicates the use of  HMAC_MD5 instead of
MD5 in the above procedure.

<<Ahmad>>
It would be beneficial to point the location of this text in relation to the
existing one.
<<Ahmad>>

(Section 9)
Parameter Name               Default Value   Section(s) of Document
 --------------              -------------   ----------------------
CHALLENGE_WINDOW                  2                  3.2
CHAP_SPI                          2                  8    
HMAC_CHAP_SPI                     3                  8

Any Comment?
 
Thanks,
Jayshree
-----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Thursday, September 26, 2002 12:13 PM
To: [email-masked]'; [email-masked]
Cc: 'Charlie Perkins'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related)
(ISSUE 15)

please see comments inline. 
Regards; 
Non-editorial comments associated with RFC3012bis: 
Please post your comments with the appropriate issue number in the subject
line (instead of simply replying to this email).
-Chairs. 

15.    Section 8 (SPI For RADIUS AAA Servers) defines a method of computing 
   the Generalized Mobile IP Authentication Extension's authenticator 
   field using MD5 in a manner that is consistent with RADIUS [9].  The 
   use of MD5 in the method described in Section 8 is less secure than 
   HMAC-MD5 [6], and should be avoided whenever possible. 
   How can it be avoided? 
   There doesn't seem to be a CHAP_SPI_HMAC_MD5 defined. 
It seems a good idea. 
Why not defining this as one of the reserved SPI value. 
Regards, 
Ahmad

---

From: "Jayshree Bharatia" <[email-masked]>
Date: Mon, 11 Nov 2002 10:31:17 -0600

Ahmad,

Thanks for your comment. Let me try section 8 again-

Existing Text
where the Type, Length, SPI, and possibly Subtype, are the fields of the
authentication extension in use.  For instance, all four of these fields
would be in use when SPI = CHAP_SPI is used with the Generalized
Authentication extension.

New Text

Thanks,
Jayshree

-----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Sunday, November 10, 2002 7:00 AM
To: Bharatia, Jayshree [RICH1:2H13:EXCH];
[email-masked]'
Cc: 'Charlie Perkins'; [email-masked]'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol
related) (ISSUE 15)

Jayshree,

Regards; 
Ahmad Muhanna 

-----Original Message-----
From: Bharatia, Jayshree [RICH1:2H13:EXCH] 
Sent: Saturday, November 09, 2002 2:17 PM
To: [email-masked]
Cc: 'Charlie Perkins'; [email-masked]'; Muhanna, Ahmad
[RICH2:2Q20:EXCH]

Proposal:

Existing text
(section 3.1 )

(section 8)

(Section 9)

New text:
(Section 3.1)

<<Ahmad>>
 
(Section 8)

<<Ahmad>>

(Section 9)

Any Comment?
 
Thanks,
Jayshree
-----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Thursday, September 26, 2002 12:13 PM
To: [email-masked]'; [email-masked]
Cc: 'Charlie Perkins'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related)
(ISSUE 15)

---

From: "Jayshree Bharatia" <[email-masked]>
Date: Tue, 12 Nov 2002 13:59:50 -0600

Issue#15: Section 8 (SPI For RADIUS AAA Servers) defines a method of

Proposal:
As per previous mailing list discussion, the suggestion was to define new
reserved SPI value (HMAC_CHAP_SPI). Please note that RFC3012bis draft still
continue to support CHAP_SPI but it also recommends an option of using new
SPI. If this new SPI is received at the Foreign Agent as a part of
generalized Mobile IP authentication extension, HMAC-MD5 will be used
instead of MD5 for computing the authenticator.

New Text (underlined):
Section 3.1: If the SPI value is chosen as CHAP_SPI or HMAC_MD5 (see section
9), then the mobile node specifies CHAP-style authentication [11] using MD5
[10] or HMAC_MD5, respectively. 
Section 8: where the Type, Length, SPI, and possibly Subtype, are the fields
of the authentication extension in use. For instance, all four of these
fields would be in use when SPI = (CHAP_SPI or HMAC_CHAP_SPI) is used with
the Generalized Authentication extension. 
However, SPI number HMAC_CHAP_SPI indicates the use of HMAC_MD5 instead of
MD5 in the above procedure. 
Section 9:
Parameter Name                  Default      Value   Section(s) of Document
 --------------                           -------------
----------------------
CHALLENGE_WINDOW        2                       3.2
CHAP_SPI                           2                        8
HMAC_CHAP_SPI                3                        8

Thanks,
Jayshree
	-----Original Message-----
	From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
	Sent: Thursday, September 26, 2002 12:13 PM
	To: [email-masked]'; [email-masked]
	Cc: 'Charlie Perkins'
	Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol
related) (ISSUE 15)
	
	please see comments inline. 
	Regards; 
	Non-editorial comments associated with RFC3012bis: 
	Please post your comments with the appropriate issue number in the
subject line (instead of simply replying to this email).
	-Chairs. 
	15. Section 8 (SPI For RADIUS AAA Servers) defines a method of
computing 
	the Generalized Mobile IP Authentication Extension's authenticator 
	field using MD5 in a manner that is consistent with RADIUS [9]. The 
	use of MD5 in the method described in Section 8 is less secure than 
	HMAC-MD5 [6], and should be avoided whenever possible. 
	How can it be avoided? 
	There doesn't seem to be a CHAP_SPI_HMAC_MD5 defined. 
	It seems a good idea. 
	Why not defining this as one of the reserved SPI value. 
	Regards, 
	Ahmad

---

From: "Jayshree Bharatia" <[email-masked]>
Date: Tue, 12 Nov 2002 13:59:50 -0600

Proposal:

New Text (underlined):

Thanks,
Jayshree
	-----Original Message-----
	From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
	Sent: Thursday, September 26, 2002 12:13 PM
	To: [email-masked]'; [email-masked]
	Cc: 'Charlie Perkins'
	Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol
related) (ISSUE 15)

---

From: "Jayshree Bharatia" <[email-masked]>
Date: Mon, 11 Nov 2002 10:31:17 -0600

Ahmad,

Existing Text

New Text

Thanks,
Jayshree

-----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Sunday, November 10, 2002 7:00 AM
To: Bharatia, Jayshree [RICH1:2H13:EXCH];

Jayshree,

Regards; 
Ahmad Muhanna 

-----Original Message-----
From: Bharatia, Jayshree [RICH1:2H13:EXCH] 
Sent: Saturday, November 09, 2002 2:17 PM
To: [email-masked]
Cc: 'Charlie Perkins'; [email-masked]'; Muhanna, Ahmad
[RICH2:2Q20:EXCH]

Proposal:

Existing text
(section 3.1 )

(section 8)

(Section 9)

New text:
(Section 3.1)

<<Ahmad>>
 
(Section 8)

<<Ahmad>>

(Section 9)

Any Comment?
 
Thanks,
Jayshree
-----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Thursday, September 26, 2002 12:13 PM
To: [email-masked]'; [email-masked]
Cc: 'Charlie Perkins'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related)
(ISSUE 15)