Subject: [mobile-ip] URGENT - rfc3012 interpretation question

From: Nish Abrol <[email-masked]>
Date: Wed, 17 Oct 2001 22:13:34 -0700

Pat/Charlie,

Really appreciate any insights into this really important interop issue for 
cdma2000:

A question regarding the  interpretation of section 8 of rfc3012. This 
section specifies how to calculate the MN-AAA authenticator. It says:

" To compute the authenticator, apply MD5 [11] computed on the
following data, in the order shown:

High-order byte from Challenge || Key ||
MD5(Preceding Mobile IP data ||
Type, Subtype (if present), Length, SPI) ||
Least-order 237 bytes from Challenge "

The question is - if the challenge has less than 237 bytes - should the 
high order byte which was already used in the MD5 calculation  be included 
again as part of the  "least-order 237 bytes from Challenge"?

e.g. if the challenge is 50 bytes in length - should the authenticator be 
calculated  as:
     (a)  authenicator = md5(byte0 || key.......|| byte1 through byte49)

or (b) authenticator = md5(byte0 || key ......|| byte0 through byte49).

       where byte0 is the most significant byte of the challenge.

A strict reading of the RFC seems to suggest (b). However, it seems  that 
calculating the MD5 authenticator with the same information(high order 
byte) at different locations of the payload weakens the authenticator.

So, what was the intention of the RFC and how should it be implemented? 
Also, do you know if RFC3012 implementations have participated in any 
bakeoffs/interops. If so, how have they interpreted this section?

Your help will be really appreciated.

Thanks
Nish Abrol
Qualcomm, Inc.

---

From: "Robert J Marks" <[email-masked]>
Date: Thu, 18 Oct 2001 16:27:49 -0500

Although I am not sure of the intention in the RFC, I agree that the
byte should not be duplicated in 2 places. I also seem to remember that
known duplication tends to weaken the security.
 
Bob

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Nish Abrol
Sent: Thursday, October 18, 2001 12:14 AM
To: [email-masked]; [email-masked];
[email-masked]
Subject: [mobile-ip] URGENT - rfc3012 interpretation question

Pat/Charlie,

Really appreciate any insights into this really important interop issue
for cdma2000:

The question is - if the challenge has less than 237 bytes - should the
high order byte which was already used in the MD5 calculation  be
included again as part of the  "least-order 237 bytes from Challenge"?

e.g. if the challenge is 50 bytes in length - should the authenticator
be calculated  as:
    (a)  authenicator = md5(byte0 || key.......|| byte1 through byte49)

A strict reading of the RFC seems to suggest (b). However, it seems
that calculating the MD5 authenticator with the same information(high
order byte) at different locations of the payload weakens the
authenticator.

Thanks
Nish Abrol
Qualcomm, Inc.