Subject: [MOBILE-IP] challenge-09 - non-skippable agent adv. extension?

From: Jouni Malinen <[email-masked]>
Date: Tue, 4 Apr 2000 19:29:18 +0300

Sorry about the timing (draft in IESG last call or having already gone
through it?), but an important issue with the challenge/response draft
appeared when we discussed using it for replay protection.

Gopal Dommety commented the backward compatibility of the draft
earlier (October 1999, Mobile IP list). Some changes were made to the
draft, but I think there is still a problem with mobile nodes not
supporting challenges.

Chapter 2 of challenge-09 defines type 24 for the challenge extension
used in the agent advertisements. This is a non-skippable type number
and RFC 2002 specifies that the messages containing unrecognized
non-skippable extensions must be discarded silently. A mobile node
that does not implement challenge/response draft would thus drop all
the agent advertisements from a foreign agent using challenge
extensions!

I would like to use the draft for replay protection, but I cannot do
it in its current state since I would like to maintain backward
compatibility. Would it still be possible to change that extension
type to be skippable or is there a good reason for keeping it
non-skippable (and preventing the use of the draft in some
environments)? The draft already specifies a method for a foreign
agent to deny a request without a challenge extension, but this cannot
be used if a mobile node does not register in the first place because
of the dropped advertisements. If the extension were skippable, the
foreign network policy could decide whether mobile nodes not
supporting the challenges would be accepted.

If the draft will be changed, a couple of minor spelling errors might
also be fixed in Section 3.2:

Regstration => Registration
Advertsements => Advertisements

--
Jouni Malinen