Subject: Re: [MOBILE-IP] Mobile IP Challenge/Response Extensions

From: Raja Narayanan <[email-masked]>
Date: Tue, 7 Dec 1999 10:57:03 -0600

Hello Folks,

I would like to bring to your attention that the MIER draft has been
re-issued to the WG.

As per feedback at the IETF, we have made several changes to the draft to
simplify and bring home the usefulness of having subtypes.

The authors of the MIER draft would like to request for engagement from the
WG to move the MIER draft as working group draft, now that the basic idea
behind it seems to be finding resonance in other drafts. It is obvious that
it would be better for the WG to standarise the "new extension format" in
one place.

The extension format with "subtypes" in the Challenge Response draft needs
to be modified to make it conform to that proposed in the MIER draft.

regards,

--Raja

-----Original Message-----
From: Charles E. Perkins [mailto:[email-masked]]
Sent: Monday, December 06, 1999 5:16 PM
To: [email-masked]
Subject: [MOBILE-IP] Mobile IP Challenge/Response Extensions

Hello folks,

I have sent a revised Challenge draft in for publication,
in response to comments received during Last Call.  For those
who do not wish to wait until the draft is available from the
standard directories, it can be retrieved from the following URL:
        http://www.iprg.nokia.com/~charliep/txt/mobilechal/mip-chal.txt

There are two notable changes in the revised draft, besides the
usual collection of wording changes.

1) The MN-AAA authentication extension is redefined to be
   a subtype of a Generalized Authentication extension.

   This follows along the same philosophy as contained within the
   recently proposed MIER draft, and is in the spirit of general
   discussions along these lines that have surfaced from time to time
   over the last several years within the Mobile IP working group.

2) The RADIUS algorithm is specified as a reserved SPI number,
   hopefully SPI == 2.  Right now, the only other reserved SPI
   number is SPI == 1, for SKIP.  I think it falls within the
   intended application of reserved SPI numbers for there to be
   SPIs that designate such specific algorithms as in this case.
   Furthermore, I think that the reserved SPI numbers are even
   more appropriate for AAA servers that do not look at the SPI
   number.

I hope that the newly revised draft and its improved functionality
will meet the expectations and needs of the cellular requirements
drafts and interested parties, as well as providing support for
future similar requirements without cramping the available space
for extension numbers.

Regards,
Charlie P.

---

From: "Karim El-Malki (ERA)" <[email-masked]>
Date: Wed, 8 Dec 1999 18:51:05 +0100

Hi Charlie

>  >>     Just as with Mobile IP, this default algorithm MUST
>  be able to be
>  >>     configured for selection at any arbitrary 32-bit SPI
>  outside of
>  >>     the SPIs in the reserved range 0-255.
>
>  > Should "MUST be able to be configured" be "MAY be configured"?
>
>  The intention is to require for any compliant implementation that
>  the algorithm be configurable at any SPI.  Then, since the
>  implementation
>  is guaranteed to support such configurability, the algorithm MAY
>  subsequently be configured at any SPI.

I understand your explanation and agree with it.
My point was that "MUST be able to be configured" sounds like a difficult
way to say this, compared to the last sentence in your explanation:
"the algorithm MAY () be configured at any SPI".

>
>  > For the case in which only a shared secret is available and no SA
>  > has been established, it should be possible to use a reserved
>  > SPI value (e.g. SPI=3) to specify the use of the default algorithm.
>  > I think that this case should be considered.
>
>  It might be a good idea to request establishment of SPI==3 (or some
>  other value) for the default algorithm.  But, can you describe the
>  way that a shared secret can be established without at the same
>  tiem establishing a security association?

If you always have an established SA then there is no problem.
If there are different levels of security and you only have a
shared key/s (e.g. supplied to you in an IC card), you would not
know what SPI to use in the MIP Authentication extension unless you
can use a well-known reserved SPI which identifies the algorithm
(e.g. SPI=3 for default alg. or other value 0-255). I guess it is
a question of flexibility.

>
>  > Also, "Just as with Mobile IP" sounds as if this is not Mobile IP.
>
>  How about "Just as with RFC 2002"?

That's fine by me.

Regards
/Karim