Subject: [mobile-ip] RFC3012Bis - Issue#2 Solution Proposal

From: "Jayshree Bharatia" <[email-masked]>
Date: Tue, 29 Oct 2002 15:16:40 -0600

Hello all,
 
RFC3012bis draft provides added functionality for reply protection between
the MN and the Foreign Agent on the top of the authentication extension
supported by RFC 3344 . 
 
As Ahmad suggested in the following email, use of "MUST" basically mandates
having the functionality supported by this draft at each Mobile Node and
Foreign Agent. This will cause an issue of interoperability if these
entities are just RFC 3344 compliant.
 
On the other hand, if the Foreign Agent is capable of supporting the
functionality offered by this draft, it will send a Challenge extension in
an Agent Advertisement and expects the Mobile Node to response with the
challenge extension in the Registration Request. If the Mobile Node doesn't
have security association with the Foreign Agent but it is capable of
supporting Challenge extension, it is desirable that the Mobile Node sends
the challenge in the Registration Request. In this case, there is no reason
not to support this feature. Hence use of "SHOULD" is better over the use of
"MAY" here.
 
Please provide your comments.
 
Thanks,
Jayshree
 -----Original Message-----
From: Muhanna, Ahmad [RICH2:2Q20:EXCH] 
Sent: Thursday, September 26, 2002 9:04 AM
To: [email-masked]'; [email-masked]
Cc: 'Charlie Perkins'
Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related )
(ISSUE No. 2)

Please see comments inline. 

Regards; 
Ahmad Muhanna 

Non-editorial comments associated with RFC3012bis: 

Please post your comments with the appropriate issue number in the subject
line (instead of simply replying to this email).

-Chairs. 

2. Section 3.1: 
   Whenever the Agent Advertisement contains the Challenge extension, if 
   the mobile node does not have a security association with the Foreign 
   Agent, then it MUST include the Challenge value in a Mobile-Foreign 
   Challenge extension to the Registration Request message.  If, on 
   the other hand, the mobile node does have a security association 
   with the foreign agent, it SHOULD include the Challenge value in its 
   Registration Request message. 

   Why the "SHOULD"? What breaks if it doesn't include it? 
   One would naively assume that it is has a MN-FA SA that there is 
   no need for the challenge. 

Since there is no mechanism for Replay Protection between the MN and the
Foreign Agent, 
My understanding is that the MN-FA Challenge extension provides this
mechanism in addition 
to the AAA authentication. 

Having said that, I believe the MN MUST always include the MN-FA Challenge
extension 
regardless if the MN has a security association with the Foreign Agent or
not. 
However, the wisdom behind making it SHOULD in the case when the MN does
have a 
security association with the Foreign Agent is quite clear.!! "Backward
Compatibility" 

What if we have a MN out there which does not understand MN-FA Challenge
extension and at 
the same time is ONLY RFC2002 compliant. Meaning, it has a security
association with the 
Foreign Agent. If we make it a MUST this MN is no longer eligible to receive
service. 
On the other hand, If we remove SHOULD all together, we lose the benefit of
Replay Protection 
mechanism for those MN which has a security association with the Foreign
Agent and at the 
same time understand MN-FA Challenge extension. "Also forward compatibility
when we have a 
mechanism to dynamically establish a security association between the MN and
the Foreign Agent 
AND the MN understand MN-FA Challenge extension for replay protection." 

Regards, 
Ahmad Muhanna