Subject: [mobile-ip] RE: mobile-ip] Re: mobile-ip] RFC2002bis

From: [email-masked]
Date: Mon, 13 Aug 2001 17:22:08 -0500

Okay here's the proposed text in the I-D :

"
5.1. Message Authentication Codes

   Home agents and mobile nodes MUST be able to perform authentication.
   The default algorithm is HMAC-MD5 [23], with a key size of 128 bits.
   The foreign agent MUST also support authentication using HMAC-MD5 and
   key sizes of 128 bits or greater, with manual key distribution.  Keys
   with arbitrary binary values MUST be supported.

   The "prefix+suffix" use of MD5 to protect data and a shared secret
   is considered vulnerable to attack by the cryptographic community.
   Where backward compatibility with existing Mobile IP implementations
   that use this mode is needed, new implementations SHOULD include
   keyed MD5 [40] as one of the additional authentication algorithms
   for use when producing and verifying the authentication data that is
   supplied with Mobile IP registration messages, for instance in the
   extensions specified in sections 3.5.2,  3.5.3, and 3.5.4.

   More authentication algorithms, algorithm modes, key distribution
   methods, and key sizes MAY also be supported for all of these
   extensions.
"

I realize your concern about backwards compatibility, but as Pat
mentioned
earlier the 2002 spec itself had a bug and since we are in the process
of fixing
that, we can also fix the security vulnerabiltiy.

-Basavaraj

> 
> On Mon, Aug 13, 2001 at 04:54:21PM -0500, 
> [email-masked] wrote:
> > Hi,
> > 
> > >> 
> > >> The working group chairs recently asked the working group,
> > >> by way of the mailing list, whether this incompatible
> > >> change would be acceptable.  The discussion was quite
> > >> limited, somewhat to my surprise.  This has been taken
> > >> as evidence that going with HMAC_MD5 is more-or-less
> > >> O.K.  Thus, it has been decided to go ahead with the
> > >> change.  On the other hand, it is conceivable that not
> > >> all interested parties have been notified of the possible
> > >> change, or have had time to reply.  If there are dissenters
> > >> to this change, now would be the time to express that
> > >> opinion.
> > >
> > >A quick question...when this was discussed on the mailing list last
> > >month, Kent and Gopal raised the issue of making MD5 also a MUST
> > >in RFC2002bis.  Discussion followed whether MD5 should be a MUST
> > >or a SHOULD for backwards compatibility...with the 
> understanding that 
> > >HMAC_MD5 would be a MUST.  So, is the idea now not to even 
> mention this
> > 
> > >use of MD5?  Please clarify.
> > >
> > 
> > The intent is to have HMAC-MD5 as the MUST for the authentication
> > algorithm. But MD5 will still be mentioned in the updated I-D.
> 
> OK...but, mentioned HOW?  MUST or SHOULD?  The issue is that 
> even though IESG advised on HMAC_MD5 as default, we need to ensure
> backwards compatibility.  And I am still unclear on the ramifications
> that Charlie outlined.  
> 
> Bottom line...breaking backwards compatibility is not acceptable or 
> advisable, especially since there are MIP deployments out there.
> 
> Thanks,
> Madhavi
> 
> > 
> > >Thanks,
> > >Madhavi 
> > 
> > -Basavaraj
>

---

From: Phil Roberts <[email-masked]>
Date: Mon, 20 Aug 2001 10:44:16 -0400

The text was posted to the mailing list.  You commented on it I believe.
MUST for HMAC-MD5, SHOULD for MD5 prefix_suffix for those nodes requiring
backward compatibility.

> -----Original Message-----
> From: Madhavi W. Chandra [mailto:[email-masked]]
> Sent: Monday, August 13, 2001 6:04 PM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: [mobile-ip] Re: mobile-ip] Re: mobile-ip] RFC2002bis
> 
>