Subject: RE: [mobile-ip] RFC 3012 - what about challenges from HA

From: "Ahmad Muhanna" <[email-masked]>
Date: Mon, 10 Dec 2001 23:51:52 -0600

Hi Henrik;

I am not sure about the mechanism of using challenges from HA. 
If we assume that there is a mechanism to use Challenges from HA, 
we still need to have a secret key between the HA and the MN to use
Challenges.

Regards;

Ahmad Muhanna
Nortel Networks
Shasta PDSN-MIP Development
Phone. + 1 972 685 1416 ESN. 445-1416
[email-masked]

-----Original Message-----
From: Henrik Levkowetz [mailto:[email-masked]]
Sent: Sunday, December 09, 2001 4:24 AM
To: mobile-ip
Subject: RE: [mobile-ip] RFC 3012 - what about challenges from HA

Hi Charlie,

	Ah, I see, then I can appreciate the reasoning. However,
what if one would like to use a pre-existing authentication
infrastructure which was designed to use challenges, instead
of creating a new set of shared secrets, public/private keys
or whatever for use with mobile ip? Might there not be a place
also for challenges from a HA in that case?

	Regards,
		Henrik

> 
> Hello Henrik,
> 
> Since the home agent has a security association with the
> mobile node, and since the registration request has
> replay protection and authentication extension, there
> isn't any need for the challenge.  The whole registration
> message data can properly be considered to be a
> challenge, because of the anti-replay data in the
> Identificatoin field.
> 
> Regards,
> Charlie P.
> 
> 
> Henrik Levkowetz wrote:
> 
> > On going over RFC 3012 and the 3012bis draft, I'm getting puzzled by
> > this:
> >
> > There is provisions for challenges to the MN from the FA, trough the
> > MIP Agent Advertisment Challenge Extension(section 2), and there is
> > provisions for challenges from all entities except the HA and FA
> > trough the Generalized Mobile IP Authentication Extension (section 5).
> >
> > But this leaves the HA hanging in the middle - there's no specific
> > challenge extension for a HA to use, and the Generalized Mobile IP
> > Authentication Extension is not defined for an HA to use.
> >
> > How Come?
> >
> >                 Henrik
> >
> > ------------------------------------------------------------------------
> > Henrik Levkowetz +46708321608 [email-masked] www.ipunplugged.com
> > ------------------------------------------------------------------------

---

From: "Henrik Levkowetz" <[email-masked]>
Date: Tue, 11 Dec 2001 18:17:15 +0100

Well, a shared secret or public-private keypair I guess. The point
is that there are a lot of companies which already have security
solutions in place that provide the shared secrets or public-private
keypairs, but are designed to work only with challenges. For instance
there are ID cards with a builtin chip which can be fed a challenge
and output a response, but the shared secret itself is not available
for use. If we could avoid having to establish an additional security
infrastructure for the MIP security associations, it would sit well
with companies that already have such solutions out there.

Best regards,
	Henrik

Ahmad wrote:
> we still need to have a secret key between the HA and the MN to use Challenges. 
> 
> Regards; 
> Ahmad Muhanna 
> 
> Nortel Networks

---

From: "Henrik Levkowetz" <[email-masked]>
Date: Tue, 11 Dec 2001 18:23:26 +0100

Best regards,
	Henrik