Subject: RE: [Mip4] review: draft-ietf-mip4-rfc3012bis-04.txt

From: "Kent Leung \(kleung\)" <[email-masked]>
Date: Thu, 1 Dec 2005 22:17:59 -0800

The MN and RADIUS client (HA) needs to follow the rules for CHAP
authentication.

Section 3.1:

   If the SPI value is
   chosen as CHAP_SPI (see Section 9), then the mobile node specifies
   CHAP-style authentication [RFC1994] using MD5 [RFC1321].

Section 8:

   To compute the authenticator, apply MD5 [RFC1321] computed on the
   following data, in the order shown:

      High-order byte from Challenge || Key ||
      MD5(Preceding Mobile IP data ||
      Type, Subtype (if present), Length, SPI) ||
      Least-order 237 bytes from Challenge 

When there is no MFCE, then HA needs to set the "Challenge" to 0 with
length of 1 (minimally) to populate the RADIUS CHAP-Password attribute
properly.  The CHAP ID is expected to be one byte for authenticator
computation.

So there is no need for MFCE because MN-FA replay protect is unnecessary
in CCoA mode, but the challenge value (i.e. zero) is still required to
properly perform CHAP authentication.

Did I miss your pt?

Kent

> > 
> > Also, MN sets the challenge value to zero in the MN-AAA 
> authenticator 
> > computation.
> 
> hmm.. how about the MN does not use any challenge value 
> (whether 0 or anything else)? it calculates the MN-AAA 
> authenticator without any challenge field. one the basic 
> clarifications that is needed is that there is no challenge 
> to use when there is no FA.
> 

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 05 Dec 2005 13:27:58 -0800

agreed. if the SPI is set to CHAP_SPI then we need to
use a challenge set to 0.

Vijay