Subject: [MOBILE-IP] MN validity checks

From: "Lila Madour (LMC)" <[email-masked]>
Date: Mon, 3 Apr 2000 15:37:30 -0400

Hi everyone,
I hope it is not too late for comments against 2002-bis.
In section 3.6.2.1 of 2002b, validity checks by the mobile node of the
registration reply, the sequencing of the events is
   1. check the identification field value
   2. Then check the authentication value in the MN-HA authentication
extension.

The MN-HA authentication extension proofs the integrity of the reply
message. If the integrity check has failed, then the identification field
cannot be trusted.
Consequently, the MN should may be check the integrity of the message first,
before checking the identification field.
The HA performs validity check that way when it receives a registration
request, whay not the MN?

Regards
/ML

---

From: Francis Dupont <[email-masked]>
Date: Wed, 5 Apr 2000 11:18:14 +0200

In your previous mail you wrote:

   Hi everyone,

=> 1 is not trust the ID but check it.

=> I disagree, the simplest (less expensive if you prefer) check must
be done first and authentication checks are far more expensive than
an ID check (then please keep the 2002-bis order).

Regards

[email-masked]