Subject: [MOBILE-IP] Regional Registration Questions

From: "[email-masked]" <[email-masked]>
Date: Wed, 10 May 2000 13:38:55 -0700

I have a couple of last questions, and assumptions regarding the above draft.

First, I am assuming that the *dynamic* security associations that get created
as a result of AAA are as follows (communication path is shown by single line,
while SAs are shown by double lines):

         +=========================+
        ||                         ||
        MN =========+              ||
        |           ||             ||
        |           ||             ||
        |           ||             ||
        FA---------GFA ========== HA
                    |              |
                    |              |
                    |              |
                   AAAF-----------AAAH

This means that the Mobile Node gets keying information that it would use to
authenticate MN-GFA messages, and the GFA would auth with the MN and the HA.
Of course, the MN would also create the MN-HA auth ext.

So, the FA should NEVER have a security association with the HA, right? And
furthermore, the MN should NEVER have a security association with the FA,
right? If not, please let me know why. The idea of the MN share an SA with
both the FA and the GFA seems odd. First, they are owned by the same
administrative domain, so they trust themselves, and it reduces the overhead
and complexity of the protocol.

Am I wrong?

PatC

---

From: "Charles E. Perkins" <[email-masked]>
Date: Wed, 10 May 2000 14:11:59 -0700

Hello Pat,

What would you say if the mobile node had a key that worked
with both the GFA and the FA simultaneously?  In other words,
what if the mobile node had a MN<-->*FA security association?
Presumably, the GFA could pass the MN<-->*FA security
association along to any foreign agent in the same domain.

Of course, any suggestions about simplifying the protocol
will be appreciated.

Regards,
Charlie P.

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 10 May 2000 14:18:16 -0700

> association along to any foreign agent in the same domain.

What would I say? I would say that it would make me REALLY happy! This
simplification would really benefit the I-D.

> Of course, any suggestions about simplifying the protocol
So, it sounds like what is needed is when the GFA receives the keying
information from the AAA infrastructure, it is able to forward the keys to the
FA. This *could* be done by using the Foreign Agent blob extensions, or
through some other yet to be defined extension.

When the FA receives the RegReq, if the MN-AAA is not present, it could then
authenticate the MN-FA. This ensures security throughout the whole path, and
minimizes the number of security associations.

Perfect!

PatC

---

From: Claude Castelluccia <[email-masked]>
Date: Thu, 11 May 2000 16:13:49 +0200

> Of course, any suggestions about simplifying the protocol

Hello Charlie,

I find the CellularIP solution quite interesting. It should be easy
to adapt it to MIP with Regional Registration?
What do you think?
regards,
Claude.

  Cellular IP IETF draft pg 14:

   "Each Cellular IP Network has a secret network key of arbitrary
length
   known to all Cellular IP nodes.  The network key is kept secret from
   mobile hosts and other nodes outside the Cellular IP Network,
   however.  Upon initial registration the Gateway must authenticate and
   possibly authorize the mobile host.  This initial authentication and
   authorization can be based on any known symmetric or asymmetric
   method.  After authentication the Gateway concatenates the key of the
   network and the IP address of the mobile host and calculates the PID
   of the mobile host by an MD5 Hash similarly as in [4]:

   PID := MD5(network key, IP address of MH)

   Then it acquires the public key of the mobile host from a trusted
   party, encrypts the PID and sends it to the mobile host.  This way
   the mobile host and the Cellular IP network have a shared secret.
   The PID remains the same during handoff and can be easily computed by
   each Base Station.

   The PID can be used to authenticate (and optionally to encrypt) IP
   packets over the air interface.  Authentication is performed by
   creating a short hash from the (PID, timestamp, packet content)
   triple that is placed into the transmitted packets.  The validity of
   each packet can be easily checked by any Base Station even
   immediately after a handoff and without prior communication with the
   mobile host or with the old Base Station."

--

----------------------------------------
Claude CASTELLUCCIA, INRIA Rhone-Alpes
ph:  +33 4.76.61.52.15 (fax: 52.52)
http://www.inrialpes.fr/planete/

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 11 May 2000 08:04:21 -0700

Hello Claude,

Generally, I would prefer to keep the security framework
separate from the regional registration document.  However,
I can offer the following comments:

>    "Each Cellular IP Network has a secret network key of arbitrary length

So far, so good...

>    The PID remains the same during handoff and can be easily computed by

This is also workable, but I don't think we should restrict
our solution to public key mechanisms only.  I think it is
just as likely that the AAA infrastructure will be used to
distribute symmetric keys.

>    mobile host or with the old Base Station."

This is also fine with me, but it has to be recognized that the
security needs for privacy over the air can be considered as
distinct from the security needs for authenticating binding
updates and registration messages.

Regards,
Charlie P.

---

From: Zoltan Richard Turanyi <[email-masked]>
Date: Thu, 18 May 2000 11:21:11 +0200

Hi Charlie,

> distribute symmetric keys.

You are definitely right. The wording of the draft suggest the exclusive
use of public key mechanisms although it is not the only way to go.

Let me clarify something here. We can divide key exchange events into
two groups (at least with Cellular IP or micro-mobility in general). The
first one is the initial key exchange between the mobile host and the
access (e.g., Celluar IP) network. Global (e.g., Mobile IP)
authentication may also happen during this phase if needed. We can say
this is similar to the process when we log in to an operating system.
The initial authentication (login) may take some time, but it needs to
be performed rarely as once connected, the user is expected to spend
some time in an access network.

The second event type happens when a mobile host already attached to an
access network changes base station. This is similar to the case when we
are already logged in to an operating system and wish to launch a new
job. Authentication in this case should be really fast.

The Cellular IP draft does not wish to specify the first, "login" type
of key exchange. (This will be influenced/solved by the global mobility
protocol. Alternatively existing ideas/protocols for dial-in
authentication and key exchange could be re-used in this context.)
The security discussion in the Cellular IP draft addresses the second
problem area, that is, how to establish a security association between
mobile hosts and the new base station after an intra-Cellular IP
handoff. For this purpose the draft describes a keying mechanism that
allows the establishment of a SA without the base station contacting
anyone apart from the mobile host. This mechanism rely on an initial key
exchange performed by whatever global AAA protocol available.

> updates and registration messages.

Again, sorry for the wording. The draft does not wish to promote an
obligatory tie between signalling authentication and data privacy. It
just states that an exisiting security association between mobile hosts
and base stations can be used for both. However, if one wish to have
separate SA for the two, I guess it is easy to solve, although
personally I do not see why it would be necessary.

Best Regards

Zoltan
--
Zoltan Richard Turanyi
Research Fellow, Ericsson Hungary
Traffic Analysis and Network Performance Lab