Subject: RE: [mobile-ip] RFC2002bis

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Wed, 5 Sep 2001 17:02:48 -0500

There might be a procedure about the bis version that I don't understand.
Can Charlie or the chairs answer this question?

Can an outside SDO refer to a bis RFC? i.e. does it have same
standard status as the non-bis RFC?
I was under impression that the RFC2002bis has ID status,
maybe I am way off in the woods???

Thanks in advance,
Madjid

-----Original Message-----
From: Marcello Lioy [mailto:[email-masked]]
Sent: Sunday, August 12, 2001 11:39 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked];
[email-masked]
Subject: Re: [mobile-ip] RFC2002bis

At 02:00 8/11/2001, you wrote:
>Hello folks,
>
>A new version of RFC2002bis has been prepared.  According
>to the most recent guidance given by the IESG, a change in
>the mandated authentication algorithm has been strongly
>suggested.  Unfortunately, this will have the effect of
>causing almost all previous implementations of Mobile IP
>for IPv4 to become incompatible with the new specification.
>
>The working group chairs recently asked the working group,
>by way of the mailing list, whether this incompatible
>change would be acceptable.  The discussion was quite
>limited, somewhat to my surprise.  This has been taken
>as evidence that going with HMAC_MD5 is more-or-less
>O.K.  Thus, it has been decided to go ahead with the
>change.  On the other hand, it is conceivable that not
>all interested parties have been notified of the possible
>change, or have had time to reply.  If there are dissenters
>to this change, now would be the time to express that
>opinion.

This could be an issue.  TIA/EIA IS-835 (the packet data standard for 
CDMA2000) is going to be deployed in North America this fall.  It specifies 
the user of RFC 2002.  There are two major areas of incompatibilty in RFC 
2002bis:
1) the inclusion of the SPI in the auth calculation
2) HMAC_MD5 if that is decided on.

Both of these things break 2002 - which means that the mobiles and 
infrastructure that are 835 compliant will be obsoleted when RFC 2002 is 
obsoleted.

I think that both of these fixes are good (the SPI was a bug that slipped 
through in 2002, and HMAC sounds like it is less vulnerable than vanila 
MD5) but they could cause issues in these planned network deployments.
-----------------------------------
Marcello (Wandering through France)