Subject: Re: [mobile-ip] Proposed changes to draft-ietf-mobileip-aaa-key-04.txt

From: Patrice Calhoun <[email-masked]>
Date: Wed, 11 Apr 2001 16:54:07 -0700

>I don't mind the change, but if the encoding is cryptographically
>strong, it doesn't increase the security by any appreciable amount.

Well, not passing a key is certainly harder to break than having a session
key pass to the mobile, which can be intercepted (or at least monitored), and
perhaps eventually attacked. If a key is derived, then the only way a session
key can be cracked is by collecting lots of packets that were authenticated
from the key, and attempting a brute force attack.

The crypto-folks here much prefer keys to be derived, and want to re-use
this scheme for their networks, if we can make the appropriate changes.

>> I just had a meeting with the 3GPP2 AHAG WG chair (the group that does all
>> cellular security), and they have concerns in regards to the above mentioned
>> draft. Instead of having the I-D define that the keys be returned to the
>> mobile node, they would prefer that a random value be sent, and have the
>> mobile node derive the session key based on a known algorithm, such as:
>> 
>>         MD5(MN-AAA Secret + NAI + Random Value)
>
>Presumably '+' is concatenation.  

yes

> I reckon MD5 should be HMAC_MD5,
>and the input data should have the secret appended also after the
>random value. 

oh, well if we want prefix+suffix, then yes, but hmac-hd5 doesn't really need
that. In fact, we could even support SHA-1 as well.

> Also, so that the algorithm will work with IP addresses
>when NAIs are not available, we should allow the identification
>bitstring to be the appropriate IP address.

sure.
>
>Did anyone contribute proposed text?

As soon as I get back from vacation I will. Of course, I want to make sure
that no one objects to this change before I propose any text.

PatC