Subject: RE: [mobile-ip] RFC2002bis

From: "Patil Basavaraj (NET/Dallas)" <[email-masked]>
Date: Thu, 6 Sep 2001 06:56:28 -0500

rfc2002bis is an I-D and NOT an RFC yet. Outside SDOs can
choose whether they want to reference an I-D, which is essentially
work in progress and has the possibility of change occuring or wait
for it to become a PS with a new RFC number. 
I think you are still on the greens in your understanding of the
status of the 2002bis I-D.

> -----Original Message-----
> From: ext Nakhjiri Madjid-MNAKHJI1 
> 
> There might be a procedure about the bis version that I don't 
> understand.
> Can Charlie or the chairs answer this question?
> 
> Can an outside SDO refer to a bis RFC? i.e. does it have same
> standard status as the non-bis RFC?
> I was under impression that the RFC2002bis has ID status,
> maybe I am way off in the woods???
> 
> Thanks in advance,
> Madjid
> 
> -----Original Message-----
> From: Marcello Lioy [mailto:[email-masked]]
> 
> 
> At 02:00 8/11/2001, you wrote:
> >Hello folks,
> >
> >A new version of RFC2002bis has been prepared.  According
> >to the most recent guidance given by the IESG, a change in
> >the mandated authentication algorithm has been strongly
> >suggested.  Unfortunately, this will have the effect of
> >causing almost all previous implementations of Mobile IP
> >for IPv4 to become incompatible with the new specification.
> >
> >The working group chairs recently asked the working group,
> >by way of the mailing list, whether this incompatible
> >change would be acceptable.  The discussion was quite
> >limited, somewhat to my surprise.  This has been taken
> >as evidence that going with HMAC_MD5 is more-or-less
> >O.K.  Thus, it has been decided to go ahead with the
> >change.  On the other hand, it is conceivable that not
> >all interested parties have been notified of the possible
> >change, or have had time to reply.  If there are dissenters
> >to this change, now would be the time to express that
> >opinion.
> 
> This could be an issue.  TIA/EIA IS-835 (the packet data standard for 
> CDMA2000) is going to be deployed in North America this fall. 
>  It specifies 
> the user of RFC 2002.  There are two major areas of 
> incompatibilty in RFC 
> 2002bis:
> 1) the inclusion of the SPI in the auth calculation
> 2) HMAC_MD5 if that is decided on.
> 
> Both of these things break 2002 - which means that the mobiles and 
> infrastructure that are 835 compliant will be obsoleted when 
> RFC 2002 is 
> obsoleted.
> 
> I think that both of these fixes are good (the SPI was a bug 
> that slipped 
> through in 2002, and HMAC sounds like it is less vulnerable 
> than vanila 
> MD5) but they could cause issues in these planned network deployments.
> -----------------------------------
> Marcello (Wandering through France)
>