Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question

From: [email-masked]
Date: Fri, 19 Oct 2001 15:47:24 -0500

I don't think that one can conclude that there is a security problem unless
it is documented.  A quick search of the web finds plenty of general concerns
with
MD5 but nothing about this particular issue.  Does copying a byte in an n byte
hash make it any less secure than the other interpretation which is an n-1
byte hash?

It is very clear that a literal reading of RFC3012 indicates that the byte
should
be copied.  There are commercial deployments that already do it this way.

-Mike

"Robert J Marks" <[email-masked]> on 10/18/2001 04:27:49 PM

Please respond to [email-masked]

Sent by:  "Robert J Marks" <[email-masked]>

To:   [email-masked], [email-masked],
      [email-masked]
cc:    (Mike Borella/MW/US/3Com)
Subject:  RE: [mobile-ip] URGENT - rfc3012 interpretation question

Although I am not sure of the intention in the RFC, I agree that the
byte should not be duplicated in 2 places. I also seem to remember that
known duplication tends to weaken the security.

Bob

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Nish Abrol
Sent: Thursday, October 18, 2001 12:14 AM
To: [email-masked]; [email-masked];
[email-masked]
Subject: [mobile-ip] URGENT - rfc3012 interpretation question

Pat/Charlie,

Really appreciate any insights into this really important interop issue
for cdma2000:

A question regarding the  interpretation of section 8 of rfc3012. This
section specifies how to calculate the MN-AAA authenticator. It says:

" To compute the authenticator, apply MD5 [11] computed on the
following data, in the order shown:

High-order byte from Challenge || Key ||
MD5(Preceding Mobile IP data ||
Type, Subtype (if present), Length, SPI) ||
Least-order 237 bytes from Challenge "

The question is - if the challenge has less than 237 bytes - should the
high order byte which was already used in the MD5 calculation  be
included again as part of the  "least-order 237 bytes from Challenge"?

e.g. if the challenge is 50 bytes in length - should the authenticator
be calculated  as:
    (a)  authenicator = md5(byte0 || key.......|| byte1 through byte49)

or (b) authenticator = md5(byte0 || key ......|| byte0 through byte49).

      where byte0 is the most significant byte of the challenge.

A strict reading of the RFC seems to suggest (b). However, it seems
that calculating the MD5 authenticator with the same information(high
order byte) at different locations of the payload weakens the
authenticator.

So, what was the intention of the RFC and how should it be implemented?
Also, do you know if RFC3012 implementations have participated in any
bakeoffs/interops. If so, how have they interpreted this section?

Your help will be really appreciated.

Thanks
Nish Abrol
Qualcomm, Inc.

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 22 Oct 2001 11:18:09 +0200 (CEST)

Whatever the best interpretation will be, the fact that this is subject
to interpretation tells me that RFC 3012 needs to be revised ASAP
with a description which is clear on this point.

Are there other issues that aren't (or weren't) clear to implementors
of RFC 3012? Any issues that required sending a question on a mailing
list or to the authors would seem like a good reason to get the
spec clarified.

  Erik

>----- Begin Included Message -----<

Date: Fri, 19 Oct 2001 15:47:24 -0500
From: [email-masked]
Subject: RE: [mobile-ip] URGENT - rfc3012 interpretation question
To: [email-masked]

-Mike

Bob

-----Original Message-----

Pat/Charlie,

Thanks
Nish Abrol
Qualcomm, Inc.

>----- End Included Message -----<