Subject: RE: [mobile-ip] Proposed changes to draft-ietf-mobileip-aaa-key-0 4.txt

From: [email-masked]
Date: Wed, 11 Apr 2001 16:55:00 -0500

Hello all,

>-----Original Message-----
>From: ext Charles E. Perkins [mailto:[email-masked]]
>Sent: 11 April, 2001 3:32 PM
>To: [email-masked]
>Cc: [email-masked]
>Subject: Re: [mobile-ip] Proposed changes to
>draft-ietf-mobileip-aaa-key-04.txt
>
>
>Hello Pat,
>
>I don't mind the change, but if the encoding is cryptographically
>strong, it doesn't increase the security by any appreciable amount.
>
>> I just had a meeting with the 3GPP2 AHAG WG chair (the group that does
all
>> cellular security), and they have concerns in regards to the above
mentioned
>> draft. Instead of having the I-D define that the keys be returned to the
>> mobile node, they would prefer that a random value be sent, and have the
>> mobile node derive the session key based on a known algorithm, such as:
>> 
>>         MD5(MN-AAA Secret + NAI + Random Value)
>
>Presumably '+' is concatenation.  I reckon MD5 should be HMAC_MD5,
>and the input data should have the secret appended also after the
>random value.  Also, so that the algorithm will work with IP addresses
>when NAIs are not available, we should allow the identification
>bitstring to be the appropriate IP address.

Probably neither the NAI nor the IP address need to be taken as an input
thus as you say, allowing many ways to identify the user. The user's
identity will already be used to retrieve the long term key.

And for the algorithm, we may want to give the possibility to use different
ones: since it is between the MN and the AAAh, the operator may prefer to
decide some proprietary algorithms

>
>Did anyone contribute proposed text?

We have actually described similar key distribution mechanims (based on
random numbers) in the following internet drafts:
http://search.ietf.org/internet-drafts/draft-le-mobileip-keydistribution-00.
txt
This document also defines another key distribution alternative based on
Diffie Hellman thus providing other security services.
The description of the two mechanisms is IPv6 specific but the same concept
(key distribution based on random numbers and key distribution based on
Diffie Hellman) could apply for MIPv4: we just need to define the extensions
to carry the appropriate information.