Subject: RE: [Mip6] FW: I-DACTION:draft-vidya-rfc4285-security-analysis-00.txt

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Fri, 22 Dec 2006 11:19:32 -0500

> -----Original Message-----
> From: Narayanan, Vidya [mailto:[email-masked]]
> Sent: Thursday, December 21, 2006 5:38 PM
> To: Chowdhury, Kuntal; [email-masked]
> Subject: RE: [Mip6] FW:
I-DACTION:draft-vidya-rfc4285-security-analysis-
> 00.txt
> 
> Hi Kuntal,
> 
> The draft only covers an analysis of the work done at the IETF
> (particularly, just RFC4285). There is no work on EMSK-based MIP keys
at
> the IETF at the moment. While using temporary IDs and removing the
need
> for using the MN-AAA key directly for protection will remove a few of
> the concerns, other concerns still exist (the ability to do protected
ID
> exchanges, changes to temporary IDs to prevent tracking, etc.). 

[KC>] No, these concerns do not exist when pseudo NAI is used. Ref WiMAX
NWG use case.

> Also,
> such methods introduce their own set of concerns that would be a
> separate discussion not under this scope.
> 
[KC>] Yes, user identity hiding is a general issue and not specific to
RFC 4285.

> Hope that helps.
> 
> Vidya
> 
> > -----Original Message-----
> > From: Chowdhury, Kuntal [mailto:[email-masked]]
> > Sent: Wednesday, December 20, 2006 10:05 PM
> > To: [email-masked]
> > Subject: RE: [Mip6] FW:
> > I-DACTION:draft-vidya-rfc4285-security-analysis-00.txt
> >
> > I find that this analysis is based on some assumptions that
> > are quite outdated. For example use of static NAI in the
> > identifier option and the use of MN-AAA key to bootstrap
> > MN-HA key. These are old assumptions regarding how the
> > industry is trying to use RFC 4285.
> >
> > In WiMAX NWG for example, the NAI is set to pseudoNAI to do
> > identity hiding. The MN-AAA AE is not used at all. The MN-HA
> > AE is used with MN-HA key which is bootstrapped from EAP
> > keying framework (EMSK -> MIP-RK -> ...).  The MN-HA SA is
> > indexed by the Mobility SPI.
> >
> > Regarding the key length issue (which we found to be the ONLY
> > real issue), we have submitted an update:
> >
> > http://tools.ietf.org/wg/mip6/draft-patel-mip6-rfc4285bis-00.txt
> >
> > -Kuntal
> >
> > > -----Original Message-----
> > > From: Narayanan, Vidya [mailto:[email-masked]]
> > > Sent: Wednesday, December 20, 2006 11:33 AM
> > > To: [email-masked]
> > > Subject: [Mip6] FW: I-D
> > ACTION:draft-vidya-rfc4285-security-analysis-
> > > 00.txt
> > >
> > > All,
> > > A number of people have asked about the security concerns with
> > RFC4285.
> > > This draft provides an analysis of that. Please send any comments
to
> > me.
> > >
> > >
> > > Thanks,
> > > Vidya
> > >
> > > > -----Original Message-----
> > > > From: [email-masked] [mailto:[email-masked]]
> > > > Sent: Tuesday, December 19, 2006 12:50 PM
> > > > To: [email-masked]
> > > > Subject: I-D ACTION:draft-vidya-rfc4285-security-analysis-00.txt
> > > >
> > > > A New Internet-Draft is available from the on-line
> > Internet-Drafts
> > > > directories.
> > > >
> > > >
> > > > 	Title		: Security Analysis of RFC4285
> > > > 	Author(s)	: V. Narayanan
> > > > 	Filename	:
draft-vidya-rfc4285-security-analysis-00.txt
> > > > 	Pages		: 9
> > > > 	Date		: 2006-12-19
> > > >
> > > >   RFC4285 [1] provides a means of using pre-shared key (PSK)
based
> > or
> > > >    AAA-based credentials for Mobile IPv6.  It is intended
> > to provide
> > a
> > > >    light-weight security mechanism for MIP6 signaling.
> > However, the
> > > >    protocol comes with a set of security issues that are worth
> > looking
> > > >    at.  This document presents a security analysis on the
> > protocol.
> > > >
> > > >
> > > > A URL for this Internet-Draft is:
> > > > http://www.ietf.org/internet-drafts/draft-vidya-rfc4285-securi
> > > ty-analysis-00.txt
> > > >
> > > > To remove yourself from the I-D Announcement list, send a
> > message to
> > > > [email-masked] with the word unsubscribe
> > in the body
> > > > of the message.
> > > > You can also visit
> > > > https://www1.ietf.org/mailman/listinfo/I-D-announce
> > > > to change your subscription settings.
> > > >
> > > > Internet-Drafts are also available by anonymous FTP.
> > Login with the
> > > > username "anonymous" and a password of your e-mail address.
After
> > > > logging in, type "cd internet-drafts" and then "get
> > > > draft-vidya-rfc4285-security-analysis-00.txt".
> > > >
> > > > A list of Internet-Drafts directories can be found in
> > > > http://www.ietf.org/shadow.html or
> > > > ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> > > >
> > > > Internet-Drafts can also be obtained by e-mail.
> > > >
> > > > Send a message to:
> > > > 	[email-masked].
> > > > In the body type:
> > > > 	"FILE
> > > > /internet-drafts/draft-vidya-rfc4285-security-analysis-00.txt".
> > > >
> > > > NOTE:	The mail server at ietf.org can return the document in
> > > > 	MIME-encoded form by using the "mpack" utility.  To use
this
> > > > 	feature, insert the command "ENCODING mime" before the
"FILE"
> > > > 	command.  To decode the response(s), you will need
"munpack"
> or
> > > > 	a MIME-compliant mail reader.  Different MIME-compliant
mail
> > > > readers
> > > > 	exhibit different behavior, especially when dealing with
> > > > 	"multipart" MIME messages (i.e. documents which have
been
> split
> > > > 	up into multiple messages), so check your local
documentation
> on
> > > > 	how to manipulate these messages.
> > > >
> > > > Below is the data which will enable a MIME compliant mail reader
> > > > implementation to automatically retrieve the ASCII version of
the
> > > > Internet-Draft.
> > > >
> >
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
> >

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6