Subject: [mobile-ip] Implementation experiences of the authentication suboption

From: Henrik Petander <[email-masked]>
Date: Mon, 10 Dec 2001 14:47:16 +0200 (EET)

Hi,

At ETSI IPv6 plugtest we successfully tested the authentication data
suboption as specified in draft 15. We used HMAC MD5 with 12 bytes of
authentication data. The test was run between HUT's MIPL MN and Nokia's
HA.  

We implemented the authentication data suboption in a few working days,
and about 180 lines of code, when using existing code (from IPSec AH) for
HMAC-MD5. Since the adding and processing of the suboption is done as a
part of the MIPv6 implementation it is easy to work with home address
options, routing headers etc.. The implementation supports hmac-md5-96 and
hmac-sha-1 and it is available from www.mipl.mediapoli.com with source
code.
 
If an authentication algorithm and its mode will be specified in the mipv6
draft then the authentication data suboption will IMO be ready for use.
Provided that no new weaknesses in HMAC MD5 have been found, RFC 2403, or
otherwise RFC 2404 could be applied directly to the authentication data
suboption.

Finishing this part of the mipv6 spec would IMHO provide an easy way to
get working authentication into the implementations, without sacrificing
anything.  The authentication suboption should also coexist with IPSec
processing without any problems, since it is just payload to any IPSec
headers.  

Regards,

Henrik Petander

		----------------------------------
		Henrik Petander 		
		Helsinki University of Technology,	
		GO/Core Project 
		[email-masked]
		Office: +358 (0)9 451 5846 
		GSM: +358 (0)40 741 5248	
		----------------------------------