Subject: [mobile-ip] Clarifications for section 5 (issue 102)

From: Jari Arkko <[email-masked]>
Date: Wed, 21 Aug 2002 15:14:42 +0300

Vladislav Yasevich wrote:

 > 1.  Multiple subsections use the symbol '|' in the cookie
 > and key calculations.  Does this symbol mean "concatinate"
 > or "Logical OR"?  (my guess is "Concatinate").  If my guess
 > is correct, in what order are the bits concatinated (i.e
 > cookie | none == ((cookie << 64) | nonce)?

It should be defined. Suggested text follows: "Here
A | B denotes concatenation of the strings A and B,
and First64(A) denotes the first 64 bits of the string A."

 > 2.  Section 5.2.5 uses a function First64() in calculating home
 > and care-of cookies.  Which bits are assumed to be the first
 > 64 bits?

Is the above enough?

 > 3.  There doesn't appear to be a section on processing and validating
 > Binding Updates.  Is it enought to make sure that authenticator
 > matches, or should the entire HMAC match?  (My guess it is the
 > entire HMAC).

and then later Hannu Flinck writes:

 > About your question 3 there is a section
 > describing BU processing and validation in 9.4.1 "Receiving Binding
 > Updates". So this should be covered.

Right. 9.4.1 and 5.2.6 together should do the job.

The rules for calculating the authenticator field indicate the use
of the MAK_(k) function which has been defined as the HMAC function.

 > However under Home Agent Operation for sake of clarity I would like
 > to propose some lines of description how a static SA is used to
 > validate the MN-HA BUs. Current text that describes in 10.2 "Primary
 > Care-of Address Registration" starts with an assumption that the BU is
 > valid. But says nothing how the validation is done. Later in section
 > 10.3 "Primary Care-of address De-Registration" the text finally refers
 > to Section 9.4.1.
 >
 > However section 9.4.1 has been written Return Routability in mind that
 > doesn't apply as such with the home agent that has IPsec

Yes, this reference isn't quite correct. But note that in 9.4.1 there
are two separate activities listed, "validation" and "authorization".
I think we can still refer to the validation steps for sequence numbers
etc, but we need a new text for the authorization part which in this case
works with IPsec. Text is being prepared for that, as required by issue
69.

Jari

---

From: Jari Arkko <[email-masked]>
Date: Wed, 21 Aug 2002 15:25:43 +0300

> and First64(A) denotes the first 64 bits of the string A."

And to make the order specified as well: "Here A | B denotes
the concatenation of the strings A and B, with the string A
appearing first in the result. First64(X) denotes the first 64
bits of the string X."

(Note that it is helpful to think about the cookies and other
data items as strings rather than as numbers.)

Jari

---

From: Vladislav Yasevich <[email-masked]>
Date: Wed, 21 Aug 2002 09:28:18 -0400

Jari

Thanks.  That clarifies a lot.

-vlad

-- 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Vladislav Yasevich	       Tru64 UNIX - IPv6 Project Lead
Hewlett Packard 	       Tel: (603) 884-1079
Nashua, NH 03062	       ZKO3-3/T07