Subject: RE: [Mip4] Re: rfc3012bis draft review

From: "Ahmad Muhanna" <[email-masked]>
Date: Tue, 14 Oct 2003 19:21:54 -0500

Henrick,

I may be missing something here.
If we are replacing the RRP coming from the HA with a new one from the FA
with error code MISSING Challenge, we do not have any problem in there and
the warning should be removed (No MN-HA authentication extension). On the
other hand, if FA is just relaying the received RRP after changing the RRP
code to MISSING CHALLENGE; definitely we have a problem and need to be
fixed.

Regards,
Ahmad

> -----Original Message-----
> From: Henrik Levkowetz [mailto:[email-masked]] 
> Sent: Tuesday, October 14, 2003 7:06 PM
> To: Muhanna, Ahmad [RICH2:2Q30:EXCH]
> Cc: Bharatia, Jayshree [RICH1:2H13:EXCH]; [email-masked]'; 
> [email-masked]'; [email-masked]
> Subject: Re: [Mip4] Re: rfc3012bis draft review
> 
> 
> Ahmad,
> 
> 	We don't have an indication that this is broken in 
> deployment. Replacing the RRP from the HA with one from the 
> FA doesn't give us 
> any security or other improvement, it only potentially breaks 
> current implementations. And that isn't something we do gratuitously.
> 
> And as long as the issue remains, the security warning should stay.
> 
> 	Henrik
> 
> 
> Tuesday 14 October 2003, Ahmad wrote:
> > The discussion here is about changing the RRP code by FA to Missing 
> > Challenge; I believe that allowing the FA to change the 
> code value in 
> > the registration reply coming from HA is wrong and needs to be 
> > corrected. Otherwise, this standard allows itself to 
> intentionally be 
> > broken.
> > 
> > I would suggest that the FA SHOULD Silently discard the RRP 
> message in 
> > the case when the value of MN-FA challenge in RRP is different than 
> > what has been sent in RRQ. If that RRP is a bogus one, the 
> correct one 
> > will soon be coming.
> > 
> > Also, I am with removing the warning from the security section.
>

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 15 Oct 2003 02:40:52 +0200

Hi Ahmad,

> code to MISSING CHALLENGE; definitely we have a problem and need to be

In both cases, the reply is without authentication, and may be spoofed.
There is no material difference security wise. For this reason, it is
preferable to relay the HA reg.reply rather than make up a new one, as
this will allow other information to go through. But then it is only 
prudent to point out that this HA reply is unsecured because of the
action of the FA in changing the reply code.

	Henrik