Subject: [MOBILE-IP]

From: "N. Asokan" <[email-masked]>
Date: Tue, 2 Nov 1999 13:37:14 +0200

Hi Raja and other Nortelliers:

Raja Narayanan <[email-masked]> wrote:
[...]
| RN>Your point regarding 'privacy is lost' is taken. We need to fine tune
| the usage of shared secret keys such that such a loss does not take place
| and we will address this in the next version of KENA .
[...]

Thanks.

[...]
| RN> The only advantage of TNAI against public or secret key is the
| computation efficiency. But I wonder if this is an issue anymore because
| processor power cheap. On the other hand introducing TNAI will add a level
| of complexity which is not necessary to manage NAIs.
| Are we missing something ?
[...]

I think the T-NAI solution will be one (if not the) answer to what you
mention above: "fine tune the usage of shared secret keys such that such a
loss does not take place" because it provides the same level of privacy as
in the public key case (without any qualifications or caveats).

What are the complexities in managing these T-NAIs?  As far as I can see,
the only additional complexity, compared to the public key case, is to
have some way for the home domain to convey the T-NAI to the MN.  This is
basically the same functionality as session keys.  One could even use the
same extensions used for delivering session keys, by using a different SA
for T-NAIs.

There is no need for any state in the home domain.  It just has to know
the master key. Consequently there is no need for any synchronization of
T-NAIs or any re-synchrnoization protocol (as is present in GSM, if I
remember right). MNs have to remember their current T-NAI. MN's usage of
NAI is basically the same: instead of computing a NAI, it uses the current
stored T-NAI.

Changing the key of the home domain is also relatively straight-forward,
as MNs are not aware of this key.

For more details, see the paper by Herzberg et al, presented at the 1994
IEEE Workshop on Mobile Computing Systems and Applications.  It is
available at:
http://www.zurich.ibm.com/Technology/Security/publications/1994.html.

Using public keys to encrypt the user part of "NAI" (it wasn't called a
NAI back then) was also described in the same workshop.  Note that it is
enough if the home domain has a public key pair, and the MN can do public
key encryption.  It is not necessary for each MN to have its own keypair.
If you are interested, I can send you a reference for this, too.

I think that the jury is still out on whether mobile nodes (especially of
the very small variety that everyone says are going to be ubiquitous soon)
can do public key crypto, even if full public key crypto ability is not
required.  I think the important point is not to mandate use of public
keys but to provide a general framework where privacy of NAIs can be
provided when necessary by a variety of means.

Regarding my comment about not overloading the meaning of the 'E' bit,
here is a suggestion: rename 'E' to 'S' and change the semantics to
        "If 1, then a 32-bit SPI field MUST follow, beginning at the next
         32-bit boundary. The recipient MUST use the SA referred by this
         SPI to interpret the contents of the extension [FILL-NAME-HERE]
         field".
This will reflect reality better (i.e.: not all security enhancements are
'encryptions').  It would make your NAI extension general enough to
support all the means of privacy we have discussed so far, while still
retaining the general structure of a MIER-style extension.

Regards,
- Asokan

---
N. Asokan, Communication Systems Lab, Nokia Research Center, Helsinki

---

From: Gerald Maguire <[email-masked]>
Date: Tue, 2 Nov 1999 14:31:36 +0100

N. Asokan wrote:

But the trend in smart cards, SIM cards, cryptodongles, etc. is to be
able to support public key crypto functions. This is encouraged by the
growth in applications using TLS (formerly SSL) and now the hype for
WTLS. There are even proposals for WPKI (a WAPified PKI system). Given
the performance of processors such as the Intel's StrongARM (which
also has very low power consumption) there is no problem supporting
PKI in mobile devices.

G. Q. "Chip" Maguire Jr.

---

From: "N. Asokan" <[email-masked]>
Date: Fri, 5 Nov 1999 09:23:21 +0200

On Tue, 2 Nov 1999, EXT Gerald Maguire wrote:
| N. Asokan wrote:
|     I think that the jury is still out on whether mobile nodes (especially of
|     the very small variety that everyone says are going to be ubiquitous soon)
|     can do public key crypto, even if full public key crypto ability is not
|     required.  I think the important point is not to mandate use of public
|     keys but to provide a general framework where privacy of NAIs can be
|     provided when necessary by a variety of means.
|
| But the trend in smart cards, SIM cards, cryptodongles, etc. is to be
| able to support public key crypto functions. This is encouraged by the
| growth in applications using TLS (formerly SSL) and now the hype for
| WTLS. There are even proposals for WPKI (a WAPified PKI system). Given
| the performance of processors such as the Intel's StrongARM (which
| also has very low power consumption) there is no problem supporting
| PKI in mobile devices.

Chip,

I agree that the trend is towards public key crypto.  But I am not sure of
two things:

1. Is public key crypto capability sufficiently widespread so as to
   mandate it in mobile-IP?
2. In addition to performance and power consumption, the other concern
   is message sizes.  For example, the size overhead in computing
   public-key-encrypted NAIs with RSA will be in the order of a few
   hundreds of bytes, depending on the key size.

   But if registration happens infrequently, this is not a problem.  Also,
   elliptic-curve-based cryptosystems  will result in a much lower size
   overhead.

Even if the answer to 1 is "yes", it would still be a good idea to provide
a general framework.  What is your take on these two issues?

Regards,
- Asokan

---

---

From: Gerald Maguire <[email-masked]>
Date: Fri, 5 Nov 1999 14:59:49 +0100

Asokan wrote:

In Sweden more than 1/4 of the population will have PKI based
certificants within the first several months of 2000 (thanks to banks,
the post office, Telia (the former PTT), the national lottery agency,
...).

A good analysis of the effect of using PKI in conjunction with IP
communication in the context of wireless systems is given in a
(M.S. level) thesis by:
   Elisabetta Carrara, "Wireless Adaptation of a security Management
   Protocol Suite", June 1999.

She shows that by usings a combination of encoding techniques that the
overhead is not as bad as one might think.

Chip

---

From: Charles Perkins <[email-masked]>
Date: Sat, 6 Nov 1999 14:08:12 -0800

Hello,

I have put a draft of the revised AAA requirements specification
on my web page:
        http://iprg.nokia.com/~charliep/txt/ietf46/aaa.ps

If you have comments for improvement, I will bring along
felt-tip pens to incorporate revisions.

Regards,
Charlie P.