Subject: Re: [Mip4] [issue 19] Multiple authorization-enabling extensions should be permitted

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 2 Feb 2004 19:23:34 +0100

Hi,

On Friday, 30 Jan 2004, Charles E. Perkins wrote:

> Here is the actual new text that should
> have been pasted in:
> 
>       a)   The home agent MUST check for the presence of at least
>            one authorization-enabling extension, and ensure that
>            all indicated authentications are carried out.  At least
>            one authorization-enabling extension MUST be present in
>            the Registration Request; and the home agent MUST either
>            check the Authenticator value in the extension or verify
>            that the authenticator value has been checked by another
>            agent with which it has a security association.  If no 
>            authorization-enabling extension is found, or if the
>            Authenticator is invalid, the home agent MUST reject the
>            mobile node's registration and SHOULD send a Registration
>            Reply to the mobile node with Code 131.  The home agent
>            MUST then discard the Request and SHOULD log the error
>            as a security exception.  If the home agent receives a
>            Registration Request without a Mobile-Home Authentication
>            extension from a Mobile Node that has a security association
>            with this home agent, the home agent MUST discard the Mobile
>            Node's Registration Request.

It seems to me that this text doesn't clearly indicate if _all_ 
authorization-enabling extensions much be successfully verified
by the home agent or its proxy, or if it is sufficient that _one_
of the authorization_enabling extensions are successfully 
verified.  So there are two issues here 
  1) Which of these alternatives do we want to require?
  2) The alternative chosen should be clearly indicated in the text

>       b)   The home agent MUST check that the registration
>            Identification field is correct using the context selected
>            by the SPI within the authorization-enabling extension
>            that the home agent used to authenticate the Mobile Node's
>            Registration Request.  See Section 5.7 for a description of
>            how this is performed.  If incorrect, the home agent MUST
>            reject the Request and SHOULD send a Registration Reply to
>            the mobile node with Code 133, including an Identification
>            field computed in accordance with the rules specified in
>            Section 5.7.  The home agent MUST do no further processing
>            with such a Request, though it SHOULD log the error as a
>            security exception.

This part of the text sounds to me as if it is enough that one of the
authorization-enabling extensions can be successfully verified. This
part is fine with me if we make that choice clearer under a).

	Regards,
		Henrik

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 2 Feb 2004 19:32:26 +0100

> - On Wednesday, 28 Jan 2004, Charles E. Perkins wrote:
>
> Section 3.6.1.3
...
> New text:
> 
>    This section describes the ordering of any mandatory and any optional
>    Extensions that a mobile node appends to a Registration Request.
>    This ordering is REQUIRED:
> 
>       a)   The IP header, followed by the UDP header, followed by the
>            fixed-length portion of the Registration Request, followed by
> 
>       b)   If present, any non-authentication Extensions expected to be
>            used by the home agent or other authorizing agent (which may
>            or may not also be useful to the foreign agent), followed by
> 
>       c)   All authorization-enabling extensions, followed by
> 
>       d)   If present, any non-authentication Extensions used only by
>            the foreign agent, followed by
> 
>       e)   The Mobile-Foreign Authentication Extension, if present.
> 
>    Note that items (a) and (c) MUST appear in every Registration Request
>    sent by the mobile node.  Items (b), (d), and (e) are optional.
>    However, item (e) MUST be included when the mobile node and the
>    foreign agent share a mobility security association.

With this new wording, it might be good (in order to avoid confusion)
to refer back to the definition in Section 1.6 of "Authorization-
enabling extension":

...
      c)   All authorization-enabling extensions, (see Section 1.6)
           followed by
...

	Regards,
		Henrik