Subject: RE: [AAA-WG]: Issue 368: Security issues with MIP-12

From: [email-masked]
Date: Mon, 23 Sep 2002 14:37:28 -0400

Hi Bernard,

Thanks for the comments and text proposals.

Bernard Aboba <[email-masked]> wrote:

>Issue 368: Security issues with MIP-12
>Submitter: Bernard Aboba
>Submitter email address: [email-masked]
>Date first submitted: September 17, 2002
>Reference:
>Document: MIP-12
>Comment type: T
>Priority: S
>Section: 5.2, 10
>Rationale/Explanation of issue:
>
>There is a potential weakness in the generation of MN session keys.
>The size of the MN-HA long term shared secret is not specified.. Recommend
>requiring this to be randomly chosen and at least 96-bits.

Very good point.

>There is also no requirement that the session keys be temporally and
>globally unique, and since they are only dependent on a 64-bit nonce, the
>MN IP address, and the long-term secret, they could repeat.
>
>While the keys are all encrypted, I'd suggest a larger nonce (128-bits),
>and some additional mixing (such as by adding the FA IP address to the
>hash).

To change functionality given in the HMAC-MD5 example (section 5.2), means changes to the draft-ietf-mobileip-aaa-key-09.txt in which the 64-bit nonce (or key material as it is called) and the “mixing” are defined. So, this would be more than editorial changes. May be a recommendation of using a nonce of 128-bits instead of a 64-bits would be enough?

/Tony

__________________________________________________________________
The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp 

Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 23 Sep 2002 15:59:38 -0700 (PDT)

> To change functionality given in the HMAC-MD5 example (section 5.2), means
> changes to the draft-ietf-mobileip-aaa-key-09.txt in which the 64-bit
> nonce (or key material as it is called) and the mixing are
> defined. So, this would be more than editorial changes. May be a recommendation
> of using a nonce of 128-bits instead of a 64-bits would be enough?

The main thing is to make sure the session key is globally and temporally
unique. If the nonce can be guaranteed to be globally and temporally
unique, then this is sufficient. If not, then additional "mixing" is
needed.

Creating a globally and temporally unique nonce is not always so easy. It
needs to be unique across AAA server reboots; across MNs; across FAs. On
average, a nonce of N bits will repeat within 2^(N/2) tries, just due to
probability.

---

From: "s. goswami" <[email-masked]>
Date: Tue, 24 Sep 2002 15:37:32 -0400 (EDT)

The draft "Diameter Mobile IPv4 Application" does not appear
to contain a reference as to how the FA is supposed to create
the MIP-MN-AAA-Auth AVP.

If there is a corresponding Mobile-IPv4 extension then that should
be mentioned (I guess it is defined in RFC 3012), as I think
it would be impossible to construct that AVP without this extension.

Subrata