Subject: [mobile-ip] MIPV6: The chicken or the egg?

From: "Greg O'Shea" <[email-masked]>
Date: Mon, 14 Oct 2002 17:58:50 +0100

More precisely: 

Which came first, the Mobility Header checksum or the Binding Update
authenticator?

The Mobility Header (6.1.1) includes a checksum whose domain includes
the Mobility Header. The Binding Update message contains an
authenticator (5.2.6) whose domain includes the Mobility Header.

Which one to calculate first? If you calculate the authenticator after
the checksum then the checksum will be invalid on arrival and the
recipient will drop the packet. If you calculate the checksum after the
authenticator then the authenticator will be invalid on arrival and the
recipient will drop the packet. 

What value does the checksum add. Do we really need it?

Greg

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 14 Oct 2002 10:34:21 -0700

> Greg O'Shea wrote:
> recipient will drop the packet. If you calculate the checksum after
> the authenticator then the authenticator will be invalid on arrival
> and the recipient will drop the packet.
> 

its for the other MH messages.

1. one easy way out. when you calculate the authenticator you
should assume the checksum field to be 0.

2. yet another option. calculate the authenticator without
the Mobility Header fields.

we have to pick one of the above. in both the cases, the 
authenticator should be computed first on the sending side.

regards
Vijay

---

From: Pekka Nikander <[email-masked]>
Date: Tue, 15 Oct 2002 08:29:16 +0300

> authenticator should be computed first on the sending side.

I think the first option is what was intented.  The purpose of the
checksum is to be able to quickly determine packets with transmission
errors.  We carefully tried to make it compatible with existing
hardware for checking UDP checksums.

But I agree that the issue must be clarified.  I've CC:d
Jari so that he can take action on this.

--Pekka

---

From: Jari Arkko <[email-masked]>
Date: Tue, 15 Oct 2002 13:05:19 +0300

Thanks for pointing this issue out, Greg! Assigned #140.

As Vijay noted the checksum is necessary for those MH messages that
don't use BAD.

And yes, we need to specify which order to do this. I also think
the checksum-is-zero-during-auth approach is the right one here.
Here's the current text in our internal draft version:

   Rules for calculating the Authenticator value are described below.

      Mobility Data = care-of address | final dest | Mobility Header Data
      Authenticator = First (96, HMAC\_SHA1 (Kbu, Mobility Data))

   where '|' is ... Mobility Header Data is the content of the Mobility
   Header, excluding the Authenticator field itself. The Authenticator
   value is calculated as if the Checksum field in the Mobility Header
   was zero.

Jari

---

From: "Emil Sturniolo" <[email-masked]>
Date: Tue, 15 Oct 2002 18:55:28 -0400

Folks,
	I don't want to rain on anyone's parade, but I have had personal
experience that some firewalls will not pass UDP frames with zero
checksums. As you might guess, this may cause interoperability problems.
Might I suggest that we come up with another solution....

Cordially,
Emil Sturniolo
[email-masked]
www.netmotionwireless.com
330-723-9099
330-421-5432 - Mobile/Voice Mail
= = = = = = = = = = = = = = = = = = = 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jari Arkko
Sent: Tuesday, October 15, 2002 6:05 AM
To: Greg O'Shea
Cc: Pekka Nikander; Vijay Devarapalli; Mobile IP Working Group
Subject: Re: [mobile-ip] MIPV6: The chicken or the egg?

      Mobility Data = care-of address | final dest | Mobility Header
Data
      Authenticator = First (96, HMAC\_SHA1 (Kbu, Mobility Data))

Jari

---

From: Pekka Nikander <[email-masked]>
Date: Wed, 16 Oct 2002 07:26:28 +0300

> Might I suggest that we come up with another solution....

Emil,

What Jari wrote (and I meant) is that the checksum in the MH header
is zero *while* the authenticator is calculated.  Once the packet
proceeds to the wire, the real checksum is calculated and all MH
headers must have a real checksum while on the wire.  This has
nothing to do with UDP other than that we hope that some existing
hardware can be reprogrammed to handle MH headers in addition
to UDP packets.

--Pekka

---

From: Jari Arkko <[email-masked]>
Date: Wed, 16 Oct 2002 07:39:25 +0300

> checksums. As you might guess, this may cause interoperability problems.

Sure, but the intention was to only calculate the authenticator with the
checksum field set to zero, the checksum would still be calculated afterwards
and transmitted as non-zero.

Perhaps the text wasn't clear on this, suggested rewording below:

     where '|' is ... Mobility Header Data is the content of the Mobility
     Header, excluding the Authenticator field itself. The Authenticator
     value is calculated as if the Checksum field in the Mobility Header
     was zero. The Checksum in the transmitted packet is still calculated in the
     usual manner, with the calculated Authenticator being a part of the
     packet protected by the Checksum.

Jari

---

From: "Emil Sturniolo" <[email-masked]>
Date: Wed, 16 Oct 2002 02:34:22 -0400

Folks,
	Thanks for the clarification. I wasn't specifically meaning UDP
in this case but was only trying to use that as an example. Maybe I
wasn't actually clear, as I was only trying to point out that some
intermediate nodes that sniff packets for correctness might
inadvertently discard the frame because of the checksum being zero. Now
that I better understand that this is only during the calculation phase,
I have no issue. Thanks again for your response.

Cordially,
Emil Sturniolo
[email-masked]

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Pekka Nikander
Sent: Wednesday, October 16, 2002 12:26 AM
To: Emil Sturniolo
Cc: 'Jari Arkko'; 'Greg O'Shea'; 'Vijay Devarapalli'; 'Mobile IP Working
Group'
Subject: Re: [mobile-ip] MIPV6: The chicken or the egg?

Emil,

--Pekka