Subject: RE: [Seamoby] [issue30] How to handle bad MN's authorization Toke n?

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Tue, 9 Dec 2003 14:46:58 -0600

Rajeev, 

I don't recall whether there was a message authentication procedure between
the pAR and nAR, if there is none, and the pAR can't verify the authorization
token, then we may open the door to DoS attacks on the pAR. So responding to 
nAR may have bad consequences...
If there is no message authentication between nAR and pAR, while you are expecting
the MN to authenticate itself to pAR (to me this is half way solution), then the 
pAR should ignore the request.

Madjid

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Rajeev Koodli
Sent: Monday, December 08, 2003 1:14 PM
To: Seamoby CTP Issues
Cc: [email-masked]
Subject: Re: [Seamoby] [issue30] How to handle bad MN's authorization
Token?

John Loughney SEAMOBY-Issues wrote:

> New submission from John Loughney <[email-masked]>:
>
> In case nAR requests the transfer by a CTR message, the pAR must verify
> the MN's authorization token. If this token is unvalid, what do we do ?
>
> Possible solutions:
>
>  - nothing ? the pAR does not answer to nAR.
>  - pAR indicates the error to nAR:
>         * In the CTD message.
>         * In a error message which could carry error information.
>

pAR MUST respond to nAR with an appropriate error.
nAR SHOULD convey the result to the MN.

-Rajeev

>
> others ?
>
> ----------
> category: Editorial
> document: draft-ietf-seamoby-ctp-05.txt
> messages: 39
> nosy: jloughney
> priority: Should Fix
> status: No Discussion
> title: How to handle bad MN's authorization Token?
> _____________________________________________________________
> Seamoby CTP Issues <[email-masked]>
> <http://danforsberg.info:8080/draft-ietf-seamoby-ctp/issue30>
> _____________________________________________________________
>
> _______________________________________________
> Seamoby mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/seamoby

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: Rajeev Koodli <[email-masked]>
Date: Fri, 12 Dec 2003 16:01:58 -0800

Hi,

is your concern message tampering between pAR and nAR ?
If so, that should apply to all contexts. I think we address that
by saying the routers SHOULD have SAs.

Regards,

-Rajeev

---

From: Julien Bournelle <[email-masked]>
Date: Tue, 16 Dec 2003 11:59:53 +0100

Hi 

> by saying the routers SHOULD have SAs.

I just wanted to note that the routers MUST have SAs. (ESP protection)

regards,

-- 
[email-masked]