Subject: RE: [mobile-ip] RFC3012-bis: compatibility issues

From: "Ahmad Muhanna"<[email-masked]>
Date: Mon, 8 Apr 2002 10:48:12 -0500

Hello Luca,

> 
> Hello Ahmad.
> 
> On Fri, 2002-04-05 at 12:08, Ahmad Muhanna wrote:
> > Hello Luca;
> > 
> > Let us agree on the following:
> > 
> > 1. The problem is of tracking the used challenges from the 
> broadcast list
> > (visible to all Mobile Nodes).
> > 2. Tracking all other per-mobile challenges (e.g. in RRP, in unicast
> > advertisement) is not a 
> > problem as long as we track a minimum of one challenge of 
> these per mobile.
> 
> I agree.
> 
> > I believe that having a USED_CHALLENGE_WINDOW of a value of 
> CHALLENGE_WINDOW
> > + 1
> > will make this work perfectly, with one condition:
> > 
> > The USED_CHALLENGE_WINDOW have two types:
> > one of the size of the CHALLENGE_WINDOW for tracking the Broadcast
> > challenges 
> > and one of the size of 1 to track the used challenges of 
> everything else.
> > 
> > This will eliminate the suggestion of preventing the Mobile 
> from using
> > certain Challenges.
> > 
> > What do you think?
> 
> I don't think that this would work as expected. The problem 
> is that this
> way the FA does not have any means of tracking the *order* in 
> which the
> client uses the broadcast challenges, and this can lead to problems.
> 
> For example, let's assume the system that you describe above is in
> place. Let's have a FA with challenge-window of 3. The FA issued
> challenges [A, B, C] as its most recent past three challenges 
> (A is the
> oldest).
> 
> A mobile uses first C, then B, then A, all in registration 
> requests very
> close to each other. Its USE_CHALLENGE_WINDOW now looks like 
> [C, B, A]:
> 'C' is going to be the first-out. 
> 
> Now the FA issues challenge 'D', and its valid window now 
> looks like [B,
> C, D]. Let's assume that now the mobile uses challenge 'D': its
> USED_CHALLENGE_WINDOW now should look like [B, A, D]. And now 
> you should
> see the problem: a malicious mobile could replay the request that used
> 'C' as the challenge: since it is in the valid window, and NOT in the
> USED_CHALLENGE_WINDOW of the mobile, the FA would accept it.
> 
I agree.

> I hope I was able to convince you (or else tire you to exhaustion with
> my complicated examples :-) that the way the draft is written now

On the contrary, I very much appreciate your detailed examples and thoughts.
However, I look at this problem as an implementation one. The suggestion
of tying this to timestamp is one way of resolving it. In other words
a proposal for solving an implementation issue, which I think, standard must
avoid addressing. What about if someone came up with another idea to solve
this 
problem. Why he needs to implement this one.

> becomes very complex and expensive to implement, unless we introduce
> some sort of timing information together with the broadcast challenges
> that mobiles use. In my opinion, the most (or only) scalable way of
> doing this would be either to not send challenges in broadcast
> advertisements (my original suggestion), or to have a 'cut-off'
> challenge like Charlie suggested.
> 
> Regards
> Luca
> 

RFC3012 already made some restriction on the Mobile node to always use the 
challenge received in the latest agent advertisement, " sort of a timestamp"

   A Registration Reply from the Foreign Agent MAY include a new
   Challenge value (see section 3.3).  The Mobile Node MAY use either
   the value found in the latest Advertisement, or the one found in
   the last Registration Reply from the Foreign Agent.  This approach
   enables the Mobile Node to make use of the challenge without having
   to wait for advertisements.

This could be interpreted that the FA SHOULD implement the same timestamp
too.
On the other hand, it leaves the door open for other creative ideas to
address this 
issue and at the same time avoid any security weakness as you clearly
identified.

Now, if an implementation chose to have a CHALLENGE_WINDOW of 2, it becomes 
much easier to trace it through a list of used challenges rather than
timestamp.

What about a CHALLENGE_WINDOW of 1.

Thanks;
Ahmad

---

From: "Ahmad Muhanna"<[email-masked]>
Date: Mon, 8 Apr 2002 10:59:07 -0500

Hello Luca;
One more point below, please.

Hello Luca, 
I agree. 

Ahmad
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
If we agree on this. Then there should be no issue.
Let us remember in all of the examples we used, we assumed that a standard
compliant Mobile Node violate this rule and does not send the challenge
received
in the latest advertisement.

What do you think?

Thanks;
Ahmad
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++