Subject: RE: [Mip4] 3344 Sending a Reg Reply when the Authenticator fails

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Wed, 21 Jun 2006 18:17:56 -0400

Madjid and all,

It does not really matter how the HA data-fills the MN-HA AE in this
case. The MN-HA AE will not pass validation at the MN regardless we put
all 0s or all non-0s.

So, my modified proposal is:

If the Authenticator is invalid, the home agent MUST reject the mobile
node's registration and SHOULD send a Registration Reply to the mobile
node with Code 131. In this case, the HA populates the MN-HA AE with any
random number. Upon receiving the RRP with error code 131, the MN skips
MN-HA AE validation and stops retrying registration attempts. The MN MAY
log this event in its internal log.

-Kuntal

> -----Original Message-----
> From: Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
> Sent: Wednesday, June 21, 2006 4:55 PM
> To: Chowdhury, Kuntal; Kent Leung (kleung); Avi Lior; Mobile IPv4
Mailing
> List
> Subject: RE: [Mip4] 3344 Sending a Reg Reply when the Authenticator
fails
> 
> Hi guys,
> 
> I agree with Kuntal, except a MUST for reject should be accompanied by
a
> MUST for sending the RRP with the code, not a SHOULD as Kuntal's text
> suggest, otherwise how would the MN know about the rejection. However,
> the MN-HA-AE filled with 0 worries me a bit, since anybody could send
> such an unsigned rejection to the MN and in a sense do a DoS for HA!!
> 
> -----Original Message-----
> From: Chowdhury, Kuntal [mailto:[email-masked]]
> Sent: Wednesday, June 21, 2006 12:05 PM
> To: Kent Leung (kleung); Avi Lior; Mobile IPv4 Mailing List
> Subject: RE: [Mip4] 3344 Sending a Reg Reply when the Authenticator
> fails
> 
> Kent/Avi,
> 
> The current text does not say that the HA cannot send RRP when auth
> fails. Rather it says that the HA "SHOULD" send RRP back to the MN:
> 
> > if the Authenticator is invalid, the home agent MUST reject the
> > mobile node's registration and SHOULD send a Registration Reply to
the
> 
> > mobile node with Code 131"
> 
> What we need is a proper description of the HA and the MN behaviors
when
> the auth fails and the HA needs to send a RRP to stop the MN from
> re-trying unnecessarily.
> 
> The clarification could be:
> 
> If the Authenticator is invalid, the home agent MUST reject the mobile
> node's registration and SHOULD send a Registration Reply to the mobile
> node with Code 131. In this case, the HA populates the MN-HA AE with
all
> 0s. Upon receiving the RRP with error code 131, the MN skips MN-HA AE
> validation and stops retrying registration attempts. The MN MAY log
this
> event in its internal log.
> 
> What do you think?
> 
> -Kuntal
> 
> > -----Original Message-----
> > From: Kent Leung (kleung) [mailto:[email-masked]]
> > Sent: Wednesday, June 21, 2006 11:43 AM
> > To: Avi Lior; Mobile IPv4 Mailing List
> > Subject: RE: [Mip4] 3344 Sending a Reg Reply when the Authenticator
> fails
> >
> > Hi Avi.  My understanding is that in this case, the HA will not be
> able
> > to send an RRP if it does not have an SA with the MN because this
> > message requires MN-HA AE.  The text state that if HA has an SA,
then
> to
> > use that in the RRP.  Without an SA, the HA should drop the RRQ,
IMHO.
> >
> > Kent
> >
> > > -----Original Message-----
> > > From: Avi Lior [mailto:[email-masked]]
> > > Sent: Wednesday, June 21, 2006 8:13 AM
> > > To: Mobile IPv4 Mailing List
> > > Subject: [Mip4] 3344 Sending a Reg Reply when the Authenticator
> fails
> > >
> > > Hi,
> > >
> > > While working a scenario in WiMAX I have run into some
> > > ambiguity in RFC3344.
> > >
> > > The HA receives a Reg Request with MN-HA-AE and NAI extension
> > > which it fails to authenticate.  In particular the HA cant
> > > authenticate because it can't obtain the MN-HA from the AAA
> > > using the NAI.
> > >
> > > >From section 3.8.2.1 RFC3344 states that a Registration
> > > Reply should be
> > > sent with code 131.
> > >
> > > "if the Authenticator is invalid, the home agent MUST reject
> > > the mobile node's registration and SHOULD send a Registration
> > > Reply to the mobile node with Code 131"
> > >
> > > And from section 3.6.2.1 describing the MN behavior we have:
> > >
> > >    "If the Code field indicates an authentication failure,
> > > either at the
> > >    foreign agent or the home agent, then it is quite possible that
> any
> > >    authenticators in the Registration Reply will also be in
> > > error.  This
> > >    could happen, for example, if the shared secret between the
> mobile
> > >    node and home agent was erroneously configured.  The mobile
node
> > >    SHOULD log such errors as security exceptions."
> > >
> > > RFC3344 also states that Registration Reply MUST include a
> > > MN-HA authentication extension:
> > >
> > > Section 3.8.3.3 says  " Note that items (a) and (c) MUST
> > > appear in every Registration Reply sent by the home agent."
> > >
> > > where  (c) is  The Mobile-Home Authentication Extension.
> > >
> > > The problem is that when MN-HA-AE fails at the HA there isnt
> > > an available MN-HA authentication extension to use.  So how
> > > can one send a registration reply?
> > >
> > > Furthermore, if the HA cant not obtain an MN-HA for the
> > > mobile, what should happen?
> > >
> > >
> > > Any help will be appreciated.
> > >
> > >
> > >
> > >
> > >
> > >
> > > ========================
> > >
> > > Avi Lior
> > > Bridgewater Systems Corporation
> > > Phone :  +1 (613) 591-9104 x6417
> > > Cell    :  +1 (613) 796-4183
> > > E-mail : mailto:[email-masked]
> > > <mailto:[email-masked]>
> > > www.bridgewatersystems.com <http://www.bridgewatersystems.com/>
> > >
> > >
> > > --
> > > Mip4 mailing list: [email-masked]
> > >     Web interface: https://www1.ietf.org/mailman/listinfo/mip4
> > >      Charter page:
> http://www.ietf.org/html.charters/mip4-charter.html
> > > Supplemental site: http://www.mip4.org/
> > >
> >
> > --
> > Mip4 mailing list: [email-masked]
> >     Web interface: https://www1.ietf.org/mailman/listinfo/mip4
> >      Charter page:
http://www.ietf.org/html.charters/mip4-charter.html
> > Supplemental site: http://www.mip4.org/
> 
> --
> Mip4 mailing list: [email-masked]
>     Web interface: https://www1.ietf.org/mailman/listinfo/mip4
>      Charter page: http://www.ietf.org/html.charters/mip4-charter.html
> Supplemental site: http://www.mip4.org/

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: "Nakhjiri Madjid-MNAKHJI1" <[email-masked]>
Date: Wed, 21 Jun 2006 19:46:07 -0400

Hi Kuntal, 

My point was not about what you put in MN-HA AE, it will be garbage
anyway. My point was if HA MUST reject it, then HA MUST make the
rejection known to MN, i.e. you cannot say "it SHOULD send a RRP".

Madjid

-----Original Message-----
From: Chowdhury, Kuntal [mailto:[email-masked]] 
Sent: Wednesday, June 21, 2006 5:18 PM
To: Nakhjiri Madjid-MNAKHJI1; Kent Leung (kleung); Avi Lior; Mobile IPv4
Mailing List

Madjid and all,

-Kuntal

Mailing
fails
a
the
when
all
this
then
IMHO.
node
> > Supplemental site: http://www.mip4.org/

"This email message and any attachments are confidential information of
Starent Networks, Corp. The information transmitted may not be used to
create or change any contractual obligations of Starent Networks, Corp.
Any review, retransmission, dissemination or other use of, or taking of
any action in reliance upon this e-mail and its attachments by persons
or entities other than the intended recipient is prohibited. If you are
not the intended recipient, please notify the sender immediately -- by
replying to this message or by sending an email to
[email-masked] -- and destroy all copies of this message
and any attachments without reading or disclosing their contents. Thank
you."