Subject: RE: [Mip4] Re: rfc3012bis draft review

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 15 Oct 2003 11:03:29 -0500

Hi Henrik,

BUT if the reply is unauthentic, how the MN would be able to use any
information in this RRP. I am really surprised that we even discuss this. On
the other hand, MN may receive two different type of replies with the same
error code (MISSING CHALLENGE).
One RRP is initiated by FA in response to RRQ with a real missing challenge
and another from the HA. How the MN would know which is which. I believe
that error code which is a FA error code should continue to be used by the
FA with RRP issued by the FA.

According to RFC3012bis section 3.4. Home Agent Processing for the Challenge
Extensions:
The HA has two options:
1. If it recognizes the Challenge extension, It must include the MN-FA
challenge back in the RRP.
2. If does not recognizes the Challenge, it MUST process the RRQ anyway
without including a challenge in the reply.

The question now is: 
When the FA will ever receive a RRP from a HA with a Challenge different
than the one sent in RRQ?

1. bogus RRP "we do not need to worry about it"
2. a NON standard HA. "We do not need to worry about it either"`

Regards,
Ahmad

> -----Original Message-----
> From: Henrik Levkowetz [mailto:[email-masked]] 
> Sent: Tuesday, October 14, 2003 7:41 PM
> To: Muhanna, Ahmad [RICH2:2Q30:EXCH]
> Cc: Bharatia, Jayshree [RICH1:2H13:EXCH]; [email-masked]'; 
> [email-masked]'; [email-masked]
> Subject: Re: [Mip4] Re: rfc3012bis draft review
> 
> 
> Hi Ahmad,
> 
> Tuesday 14 October 2003, Ahmad wrote:
> > If we are replacing the RRP coming from the HA with a new 
> one from the 
> > FA with error code MISSING Challenge, we do not have any problem in 
> > there and the warning should be removed (No MN-HA authentication 
> > extension). On the other hand, if FA is just relaying the 
> received RRP 
> > after changing the RRP code to MISSING CHALLENGE; 
> definitely we have a 
> > problem and need to be fixed.
> 
> In both cases, the reply is without authentication, and may 
> be spoofed. There is no material difference security wise. 
> For this reason, it is preferable to relay the HA reg.reply 
> rather than make up a new one, as this will allow other 
> information to go through. But then it is only 
> prudent to point out that this HA reply is unsecured because 
> of the action of the FA in changing the reply code.
> 
> 	Henrik
>

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 16 Oct 2003 00:45:09 +0200

Ahmad,

	I think it's up to you to show that the mechanism in rfc 3012
Section 3.2 is broken. I don't think it is, and you haven't shown why
3.2 is bad.

Until we get a clear case description of why and how 3.2 is broken, it
should stay as it is, and so should the security considerations.

	Henrik