Subject: RE: [mobile-ip] Concerns/comments for aaa-keys and gen-key

From: Erik Nordmark <[email-masked]>
Date: Fri, 28 Sep 2001 16:46:18 +0200 (CEST)

Christopher,

> I have the following comments regarding your concerns with the current
> aaa-keys procedure:
> 
> 1) Keying material is used between the MN and FA (or MN and HA) because a
> Key Agreement Protocol is used as opposed to simply encrypting and
> distributing the MN-HA or MN-FA key.  The reason for using a key agreement
> protocol is that the MN-FA link and/or MN-HA link may be over-the-air which
> is inherently more vulnerable to eavesdropping and cryptanalysis.  Please
> review the attached comments, originally sent to Charlie Perkins and Pat
> Calhoun, regarding the vulnerabilities associated with their original
> proposal to simply encrypt the MN-HA and/or MN-FA key for transmission to
> the MN.

I understand the requirement; I just wonder whether the suggested
protocols actually satisfy the security requirements.

> Key Agreement Protocols are well understood and have been used for many
> years in GSM and North American cellular/PCS networks to enable secure
> session key generation (in a symmetric/secret key system).

Has the security of those protocols been analysed in the open
literature? Do you have pointers to such analysis papers?

> Note: It is assumed that AAA links to other MIP entities (AAA, HA and FA)
> will be protected.

One of my questions was whether there was an assumption about encryption
being used to prevent evesdropping on these links, or if it is viewed
sufficient from the key agreement protocols if this communication 
is provided with integrity protection? Replay prevention or not?
(The term "protected" is a bit unspecific.)

> 2)  With regard the AAA-to-AAA, AAA-to-HA and AAA-to-FA links, 3G Wireless
> providers intend to protect these links using one of several techniques: 1)
> IPsec, 2) Linked encryption boxes, or 3) private commication links.
> Distribution of AAA keys is NOT OUR ONLY CONCERN on these links.  We intend
> to encrypt all data between the AAA and HA/FA for subscriber privacy reasons
> and other security concerns.  Assuming we intend to protect these links
> using techniques outside the scope of MIP, it is inefficient from our
> perspective to utilize a more elaborate key distribution scheme between the
> AAA and other network infrastructure components (which are controlled by the
> service providers).  In other words, we'll already have an SA established
> between these entities and don't need to deal with bootstrapping even
> another SA!
> 
> I do recognize that other implementations of MIPv4 will require more
> inherent security compliance (architecturally built-in SA establishment
> schemes) because most users/system operators will not have the security
> expertise/resources of large service providers.  I recommend that a separate
> procedure/protocol be developed to satisfy this requirement without delaying
> the implementation of the existing scheme.

There are subtly but importantly different interpretatiosn of what
you say above. Let me restate and see if you agree with either one of these:
 We know that the IETF protocols and mechanisms for securing the communication
 between FA, AAA*, and HA will not satisfy the security requirements for
 3G wireless use. But don't worry because we will use other security protocols
 to make sure we get adequate protection.
 We do need the aaa-key and related IETF documents to move forward in the 
 IETF so that we can get adequate protection for the communication 
 involving the MN.

or

 For other reasons we will be using non-IETF standard mechanisms for securing
 the communication between FA, AAA*, and HA thus we do not care
 (and perhaps also "have not analysed") the security that the internet drafts 
 propose to add for the communication between FA, AAA*, and HA.
 We do need the aaa-key and related IETF documents to move forward in the 
 IETF so that we can get adequate protection for the communication 
 involving the MN.

Does either of the above get close to being a restatement of what you said
in the paragraphs above?

  Erik