Subject: RE: [mobile-ip] Binding Authorization data for Binding Update toH ome Agent

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 15 Oct 2002 18:30:07 +0200

> > In a thread back in March it was decided that Home Agents 
  > need not store
  > > sequence numbers in non-volatile storage since the 
  > overhead required
  > > could be significant.  This was the reason Section 14.3 
  > was written the
  > > way it was and a key management mechanism recommended.
  > 
  > I must have missed that!  Doesn't it make more sense to keep
  > the sequence number stored along with the security association,
  > since it's useful to avoid the vulnerability you point out?
  > Or is the point that one would like to have the security association
  > parameters stored permanently?

=> The problem is that with manual keying you will eventually
(regardless of where the seqno is stored) reuse the same 
numbers (see Mike's if statement). With dynamic keying you won't.
So there is minimal replay attack protection when manual
keying is used.

Hesham

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 15 Oct 2002 09:43:25 -0700

Hello Hesham,

> So there is minimal replay attack protection when manual

This is the reason that one might wish to re-key after
65,000 Binding Updates (every 7.5 years, if you change
care-of addresses once an hour 24 hours a day 7 days a
week).  In fact, a clever home agent might make rekeying
far less frequent by keeping track of which sequence
numbers were used with which care-of addresses, but
that takes a lot of storage.  Anyway, this would be
a matter for emphasis in the Security Considerations.

Regards,
Charlie P.