Subject: [mobile-ip] Clarrification in RFC 3012 for computing MN-AAA authenticator

From: "Gowri Makineni" <[email-masked]>
Date: Tue, 16 Apr 2002 16:38:03 -0400

Hi,

I was wondering if anyone could clarrify my doubt as to how to compute the 
MN-AAA authenticator as stated in Section 8. of RFC 3012.

It states:
To compute the authenticator, apply MD5 computed on the following data, 
in the order shown: 
High-order byte from Challenge || Key || 
MD5(Preceding Mobile IP data || Type, Subtype (if present), Length, SPI) || 
Least-order 237 bytes from Challenge

I have the following questioins:

#1. When we say Preceding Mobile IP data, do we also include the MN-FA challenge in it?

#2. Regarding the least-order 237 bytes from Challenge, if the challenge has only
   10 bytes, do we include all ten bytes (repeating the first one) ?

#3. Why do we include the Challenge value of MN-FA challenge twice (if the answer to
    question #1 is true, the first time we compute the MD5 on the preceding Mobile IP
    Data and the second time we use that info to compute the overall MN-AAA authenticator) ?

#4. I am a little bit confused because in Section 3.2, Foreign Agent Processing for 
    Registration Requests it says:

"In the event that the Challenge extension is authenticated through the Mobile-Foreign 
Authentication Extension, the Foreign Agent MAY remove the Challenge Extension 
from the Registration Request without disturbing the authentication value computed by 
the Mobile Node for use by the AAA or the Home Agent. If the Challenge extension 
is not removed, it MUST precede the Foreign-Home Authentication extension."

   My question is that if the FA removes the extension, will the authenticator not be 
   affected whether the authenticator be computed based on section 6. or section 8
   if and only if the answer to question #1 is True ?

Thanks for enlighting me in advance,

-Gowri