Subject: [mobile-ip] A proposed solution for replay protection mechanism in draft-ietf -mobileip-reg-revok-04.txt

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 18 Dec 2002 19:01:36 -0600

Hello all,

The basic idea of this solution is very simple:
Since in every successful MIP registration, both the FA and HA saves the RRQ
ID as part 
of the MN binding entry, any agent which needs to inform the other mobility
agent of the 
registration revocation of a certain MN can use the RRQ ID of the last
successful registration 
for this MN for replay protection in the revocation message.

I will propose two different mechanisms and allow the group to choose one of
them.

Proposal No. 1:
i.  In this proposal ONLY the low-order 32 bits of the RRQ of the last
successful MIP 
    registration is used. This is supposedly a good random number too. Just
for simplicity 
    and avoiding very long text repetition, I would like to reference this
as the 
    SEQUENCE NUMBER.

ii. Also for simplicity, I would reference the Foreign Domain Identifier as
the high-order 
    32 bits of the revocation message ID and the Home Domain Identifier as
the low-order 
    32 bits of the revocation message ID.

FA sends a revocation message:
1. FA inserts the SEQUENCE NUMBER in the high-order 32 bits of the
revocation message ID.
2. FA insert a 0x00000000 in the low-order 32 bits of the revocation message
ID. This to 
   differentiate between revocation messages originated by the FA and those
originated 
   by the HA to prevent Malicious Reflectors attack.

HA sends a revocation message:
1. HA inserts the SEQUENCE NUMBER in the high-order 32 bits of the
revocation message ID.
2. HA insert a 0xffffffff in the low-order 32 bits of the revocation message
ID. This to 
   differentiate between revocation messages originated by the HA and those
originated 
   by the FA to prevent Malicious Reflectors attack.

For revocation acknowledgement in response to receiving a revocation
message:
1. The receiving mobility agents copies the high-order 32 bits of the
revocation message ID
   into the high-order 32 bits of the revocation acknowledgement.
2. If the receiving mobility agent is the FA, it sets the low-order 32 bits
of the revocation
   acknowledgement into 0x00000000.
3. If the receiving mobility agent is the HA, it sets the low-order 32 bits
of the revocation
   acknowledgement into 0xffffffff.

NOW: 
1. Let us remember that when any mobility agent receives a revocation
message, this agent 
locates the MN entry using the Home Address or the provided NAI of one the
MNs in case of 
multiple revocations.
This mobility agent compares the value received in the high-order 32 bits of
the revocation 
message ID with the low-order 32 bits of the saved RRQ message ID of last
successful MIP 
registration to ensure that this is a fresh revocation message.

2. If the receiving mobility agent is the FA, it must make sure that the
low-order 32 bits
of the revocation message ID is set to 0xffffffff to prevent any Malicious
Reflectors attack.

3. If the receiving mobility agent is the HA, it must make sure that the
low-order 32 bits
of the revocation message ID is set to 0x00000000 to prevent any Malicious
Reflectors attack.

Proposal No. 2:
In this mechanism, the whole 64 bits of the RRQ message of last successful
MIP registration is 
used as follows:

FA sends a revocation message:
1. FA inserts the high-order 32 bits of the RRQ message of last successful
MIP registration
   in the high-order 32 bits of the revocation message ID.
2. FA insert the SEQUENCE NUMBER in the low-order 32 bits of the revocation
message ID. In
   other words FA copies the RRQ message ID of the last successful MIP
registration into 
   the 64 bits of the revocation message ID as is.

HA sends a revocation message:
1. HA inserts the SEQUENCE NUMBER in the high-order 32 bits of the
revocation message ID.
2. HA insert the high-order 32 bits of the RRQ message ID of last successful
MIP registration
   in the low-order 32 bits of the revocation message ID. This to
differentiate between 
   revocation messages originated by the HA and those originated by the FA
to prevent 
   Malicious reflectors attack.

For revocation acknowledgement in response to receiving a revocation
message:
In the case of revocation acknowledgement message, the initiating mobility
agent always 
copies the low-order 32 bits and the high-order 32 bits of the received
revocation message 
ID into the high-order 32 bits and the low-order 32 bits of the revocation
acknowledgement 
message ID; respectively.

I hope I did not miss anything,
Your input is greatly appreciated.

Regards;
Ahmad Muhanna