Subject: RE: [Mip4] 3344 Sending a Reg Reply when the Authenticator fails

From: "Venkateshwara Sastry \(vsastry\)" <[email-masked]>
Date: Fri, 23 Jun 2006 12:49:12 +0530

We can not really claim that current protocol allows HA to respond on
auth failure. If HA responding on auth failure was really the intention
of the designers, silently discarding such packets by MN as indicated in
following text does not make sense.
      b) If the Code field indicates that service is denied by the home
         agent, or if the Code field indicates that the registration was
         accepted by the home agent, exactly one Mobile-Home
         Authentication Extension MUST be present in the Registration
         Reply, and the mobile node MUST check the Authenticator value
         in the Extension.  If the Registration Reply was generated by
         the home agent but no Mobile-Home Authentication Extension is
         found, or if more than one Mobile-Home Authentication Extension
         is found, or if the Authenticator is invalid, the mobile node
         MUST silently discard the Reply and SHOULD log the event as a
         security exception.
Regards
Sastry

________________________________

	From: Chowdhury, Kuntal [mailto:[email-masked]] 
	Sent: Friday, June 23, 2006 4:56 AM
	To: Avi Lior
	Cc: Mobile IPv4 Mailing List
	Subject: RE: [Mip4] 3344 Sending a Reg Reply when the
Authenticator fails

	Avi,

	If a rogue MN can break into the network (i.e. pass access
auth), anything is possible. However, by putting multiple levels of auth
(at least 1 or 2); the operators make this possibility extremely slim.
So, let's not get hung-up with the fact that rouge MNs can do bad
things.

	The issue is simple: if the auth of a RRQ fails, should the HA
respond back to the MN? There are some people who believe a response
should be sent. There are some who believe that the HA should silently
discard the packet.

	In this context, the current mip4 protocol allows the HA to send
a response upon auth failure. The current text also allows those HA
implementations which like to silently discard the packet. So, let's not
change the protocol as it allows both the behaviors/implementations. We
can just clarify some text to describe how the response packet is
formatted.

	-Kuntal

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: "Avi Lior" <[email-masked]>
Date: Sun, 25 Jun 2006 19:37:49 -0400

I think the protocol does allow an HA to respond with an auth failure.
Code 131 was designed for that no?
 
However, as you point out an MN receiving a RRP which fails its auth
check MUST silently discard.  Silently discard means no more processing.
Does that mean that the MN is not allowed to use the receipt of the RRP
to stop sending any further RRQs?  Some would say yes.
 
Therefore, why allow the HA to send an RRP when clearly the MN will
silently discard it?
 
Is this a contradiction or is it by design?

	From: Venkateshwara Sastry (vsastry) [mailto:[email-masked]] 
	Sent: Friday, June 23, 2006 4:19 PM
	To: Chowdhury, Kuntal; Avi Lior
	Cc: Mobile IPv4 Mailing List
	Subject: RE: [Mip4] 3344 Sending a Reg Reply when the
Authenticator fails

	We can not really claim that current protocol allows HA to
respond on auth failure. If HA responding on auth failure was really the
intention of the designers, silently discarding such packets by MN as
indicated in following text does not make sense.
	      b) If the Code field indicates that service is denied by
the home
	         agent, or if the Code field indicates that the
registration was
	         accepted by the home agent, exactly one Mobile-Home
	         Authentication Extension MUST be present in the
Registration
	         Reply, and the mobile node MUST check the Authenticator
value
	         in the Extension.  If the Registration Reply was
generated by
	         the home agent but no Mobile-Home Authentication
Extension is
	         found, or if more than one Mobile-Home Authentication
Extension
	         is found, or if the Authenticator is invalid, the
mobile node
	         MUST silently discard the Reply and SHOULD log the
event as a
	         security exception.
	
	Regards
	Sastry

		From: Chowdhury, Kuntal
[mailto:[email-masked]] 
		Sent: Friday, June 23, 2006 4:56 AM
		To: Avi Lior
		Cc: Mobile IPv4 Mailing List
		Subject: RE: [Mip4] 3344 Sending a Reg Reply when the
Authenticator fails

		Avi,

		If a rogue MN can break into the network (i.e. pass
access auth), anything is possible. However, by putting multiple levels
of auth (at least 1 or 2); the operators make this possibility extremely
slim. So, let's not get hung-up with the fact that rouge MNs can do bad
things.

		The issue is simple: if the auth of a RRQ fails, should
the HA respond back to the MN? There are some people who believe a
response should be sent. There are some who believe that the HA should
silently discard the packet.

		In this context, the current mip4 protocol allows the HA
to send a response upon auth failure. The current text also allows those
HA implementations which like to silently discard the packet. So, let's
not change the protocol as it allows both the behaviors/implementations.
We can just clarify some text to describe how the response packet is
formatted.

		-Kuntal