Subject: [MOBILE-IP] Mobile IPv4 Challenge/Response Extensions

From: Kory Keith <[email-masked]>
Date: Tue, 12 Dec 2000 08:53:29 -0800

Questions concerning the new RFC:
Section 3.2:
Concerning STALE_CHALLENGE, the language used suggests
that the Foreign Agent should keep all Challenge
extensions that the MN has previously used. Surely,
the FA can't be expected to store all of these values
for the lifetime of the Moblie's session.
If so, the memory requirement for supports the FAC go
off the chart for any reasonable amount of
subscribers.
If not, what then is the functional difference between
STALE_CHALLENGE and UNKNOWN_CHALLENGE? Both are
reported as errors, but I'm unsure of the handling by
the MN for these two errors.
Also, does the FA keep the last advertised Challenge
as an "always acceptable" value, or once the FA sends
a RRP with a valid new Challenge, the AA becomes
stale?

Thank you,

Kory Keith

=====
[email-masked]

__________________________________________________
Do You Yahoo!?
Yahoo! Shopping - Thousands of Stores. Millions of Products.
http://shopping.yahoo.com/

---

From: Woo-June Kim <[email-masked]>
Date: Fri, 15 Dec 2000 11:09:51 +0900

Hi,

Interesting point, I agree the wording is a bit unclear. 
Comments below...

>off the chart for any reasonable amount of

STALE_CHALLENGE should be sent if "it is a previously used" one. I thought that this meant that the mobile had previously sent a correct RRQ with MN_AAA, the PDSN had replied and sent back a RRP. 

The fact that the mobile again uses the same challenge value would seem to point to the possibility that the mobile had failed to received the RRP and was retransmitting... (A replay attack should be caught by the ID field)

>the MN for these two errors.

Seems there is a hole in section 3.1. It states what should be done by the MN if it receives an UNKNOWN_CHALLENGE, but nothing about STALE_CHALLENGE. (Based on my thinking above, it seems the mobile should just drop it.)

>a RRP with a valid new Challenge, the AA becomes

According to Section 3.2 and 9, the FA should keep as acceptable challenge values the last challenge sent out in a successful RRP, or the last CHALLENGE_WINDOW number of Agent Advertisements.

Don't think "Staleness" applies here, if the challenge is not among these, the UNKNOWN_CHALLENGE should be sent.

cheers

Woojune Kim