Subject: RE: [mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.1

From: Shaji Radhakrishnan <[email-masked]>
Date: Fri, 6 Jul 2001 11:29:14 -0400

Hi JH Song,
Thanks for the reply. Please see my comments.
Thanks
- shaji

-----Original Message-----
From: junhyuk song [mailto:[email-masked]]
Sent: Friday, July 06, 2001 5:21 AM
To: [email-masked]
Subject: Re: [mobile-ip] Mobile IPv4 Authentication Internt Draft revision
0.1

Hi Shaji,
 
Please read my comment below,

----- Original Message ----- 
From: Shaji Radhakrishnan <mailto:[email-masked]>  
To: [email-masked]' <mailto:'mobile-
[email-masked]'>  
Sent: Friday, July 06, 2001 6:45 AM
Subject: Re:[mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.
1

Hi JH Song,
 
I have a small doubt regarding your draft.
 
According to RFC 3012, each re-registration by the mobile node SHOULD use
different 
challenge provided by the Foreign Agent (either in Agent advertisements or
last registration reply).
From your draft it is not clear that  the mobile node continue using the
old key generated from the old challenge
(i.e , the very first challenge in the advertisement) or each generate a
new key based on the new challenge
received in the reply or advertisements. One solutions to this is that HA
must also check the received challenge
value in the registration request, along with NAI and or Home IP address.
 
The MN will be using new challenge for creating MN-HA shared that came
along RRP upon every re-registration.
However, it is not necessary to keep updating MN-HA shared key upon every
re-registration, 
because MN-HA shared key can be used until user terminate the MIP session.  
In addition if the optional lifetime of MN-HA key is used, 
MN and HA will refresh MN-HA shared key only if the MN-HA share key
lifetime is expired.
Please see section 4, Key Management of our Internet Draft 0.1 version.
 
........ <<my new reply begins>>
 
I agree that it is not necessay to update MN-HA key for each re-
registration. But how does the HA
know that mobile node is using the new key (generated from the new
challenge in latest RRP) or 
the old key? This is because for each registration reply, the Foreign Agent
sends a new challenge
and mobile node sends this challenge to HA in the next re-registration
request. At this moment, which
key the mobile node should uses. The old one from already generated for the
previous request or a new
one generated from the last received challenge? Here two cases
If the mobile node uses the old key and the new challenge, what should HA
do?
If the mobile ndoe uses the old key and old challenge, and is this case,
the FA may reject the RRQ
with STALE_CHALLENGE or UNKOWN_CHALLENGE.

Also what happens for the following scenario:
The mobile node is not having any idea about the lifetime of the share-key.
The mobile node uses 
the old key, and the new challenge received from the last RRP, for the re-
registration. Now when
HA receives this RRQ, suppose the life time is expired. So it will get the
new key based on the
new challenge? 
 
What I meant is that HA should compare the challenge value in the re-
registration
message to see whether it should use the old cached key or to get a new key
from AAAh.
If HA receives a challenge value different that that it used to get the
shared key from AAAh earlier,  
it should not matter whether previous key lifetime valid or not, HA should
get the new key since
Mobile node is using the new key.
 
...... <<my new reply ends>>
 
Also if mobile node is using new key (since it used the new challenge) in
the re-registration, it MUST include
the NAI in the registration request eventhough MN-AAA extension is not
present, and only MN-HA authentication extension
is present. Then only AAAh can compute the key in this re-registration case.
 
If your concern is not resolved until you read this, I must be
misunderstand your question.
 
The reason I use the NAI rather than IP address on computing MN-HA shared
key is to support Dynamic MIP case.
In that case, NAI must be presence, therefore NAI can be replaced by MN IP
address. 
And RFC-3012 state the case HA received MN-AAA authentication with FAC
extension.
Besides, AAA is the entity that create the new MN-HA shared key, HA shall
fetch or receive MN-HA shared key from AAA.
 
Could you elaborate your question?
 
...... << my new reply begin>> ...
 
You misunderstood my question. What I meant is that mobile node uses MN-AAA
authentication with NAI
for the initial registartion. Then it uses MN-HA authenitcation and Home IP
address for all subsequest 
re-registration. Is this case possible that it is not using NAI for
subsequent re-registrations, but only
non-zero home ip address. If this is the case, no NAI present for the home
agent to get the new shared key for
the re-registrations. This make mandatory for the mobile node to send NAI
in the re-registration messages along 
with MN-HA authentication extension. This point was not clearly stated in
your document,  
(sorry if I might have missed it).
 
...... << my new reply ends>> ...
 
Regards,
JH SONG
 
Thanks
- shaji

-----Original Message-----
From: junhyuk song [mailto:[email-masked]]
Sent: Wednesday, July 04, 2001 8:14 PM
To: [email-masked]
Subject: [mobile-ip] Mobile IPv4 Authentication Internt Draft revision 0.1

Hi All,

We recently submitted the revision of Internet draft draft on "MIPv4
Authentication Shared Secret Generation.
 
draft-song-mobileip-mipv4-auth-secgeneration-01.txt  

Regards,
JH SONG