Subject: [mobile-ip] Proposed changes to draft-ietf-mobileip-aaa-key-04.txt

From: Patrice Calhoun <[email-masked]>
Date: Wed, 11 Apr 2001 14:55:02 -0700

All,

I just had a meeting with the 3GPP2 AHAG WG chair (the group that does all
cellular security), and they have concerns in regards to the above mentioned
draft. Instead of having the I-D define that the keys be returned to the
mobile node, they would prefer that a random value be sent, and have the 
mobile node derive the session key based on a known algorithm, such as:

	MD5(MN-AAA Secret + NAI + Random Value)

So, since the mobile knows its secret with the AAAH, and its NAI, if it 
receives the random value it could derive the key. This means that no encrypted
key is ever sent over the air and is more secure.

Does anyone have *any* objections to making such a change?

PatC

---

From: David Frascone <[email-masked]>
Date: Wed, 11 Apr 2001 14:25:46 -0500

So, the keys would be the 16 byte MD5 hash?  I can live with that.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Wed, 11 Apr 2001 13:32:08 -0700

Hello Pat,

I don't mind the change, but if the encoding is cryptographically
strong, it doesn't increase the security by any appreciable amount.

>         MD5(MN-AAA Secret + NAI + Random Value)

Presumably '+' is concatenation.  I reckon MD5 should be HMAC_MD5,
and the input data should have the secret appended also after the
random value.  Also, so that the algorithm will work with IP addresses
when NAIs are not available, we should allow the identification
bitstring to be the appropriate IP address.

Did anyone contribute proposed text?

Regards,
Charlie P.