Subject: RE: [mobile-ip] AAA keys security review

From: [email-masked]
Date: Fri, 15 Mar 2002 23:14:20 +0200

Hi All,

> I asked Luis Sanchez (chair of ipsp WG) to review this doc for us and he
> did.  We're very grateful.  Here's the note he sent with his review 
> embedded.  Please note, this was done on
> version -08 before Charlie produced version -09.

One issue from the Diameter last call is:

 Issue 215: Use of hmac-md5 is incorrect 
 Submitter name: Pat Calhoun 
 Submitter email address: [email-masked] 
 Date first submitted: 25-Oct-01 
 Reference: 
 Document: base, aaa-keys 
 Comment type: Technical 
 Priority: 1 
 Section: 
 Rationale/Explanation of issue: 
 
 Need to make use that the use of md5 and hmac-md5 is consistent across 
 both drafts. The latest aaa-keys uses hmac-md5, but uses the incorrect 
 function prototype (it uses hmac-md5 with a prefix+suffix mode). 

I don't know if this has been fixed or not in the AAA-keys
doc.

John

---

From: Charlie Perkins <[email-masked]>
Date: Fri, 15 Mar 2002 13:54:31 -0800

Hello John,

This is fixed in revision -09.

Regards,
Charlie P.