Subject: RE: [mobile-ip] RFC3012-bis question

From: "Jayshree Bharatia" <[email-masked]>
Date: Fri, 31 Jan 2003 11:46:32 -0600

Hello Yoshi,

> 
>  Sorry for my late reply.  Looking from a mobile node, my
>  understanding of the 3.1 MISSING_CHALLENGE is as follows:
>  - When a mobile node receives MISSING_CHALLENGE, and only if
>    it didn't include a challenge in the previous registration
>    request, it will include an unused challenge and re-send a
>    registration request to the foreign agent.
> 

This is my understanding also. I will update current definition (section
3.1) of MISSING_CHALLENGE to reflect this.

>  Well, a bad mobile node might keep sending registration
>  requests each time it receives a MISSING_CHALLENGE.  So, a
>  foreign agent had better prevent it, I agree.  Should we
>  make clear of it ???

In order to handle this type of bad behaviour at the FA, the FA needs to
keep track of failures due to MISSING_CHALLENGE. I would think that this is
really not desirable for something which is caused by the implementation
issue at the MN. 

Regards,
Jayshree

> at Wed, 29 Jan 2003 16:46:15 -0800 (PST), Sivasundar Ramamurthy wrote:
> >
> >> I guess you are saying it depends on how you understand sec 3.2. 
> >> 
> >> ".. sec 3.2 ... Also in this case, the Foreign Agent MUST reject
> >> any Registration Reply message coming from the Home Agent that
> >> does not also include the Challenge Extension with the same
> >> Challenge Value that was included in the Registration Request.  
> >> .."
> >> 
> >> Your explanation seems to imply that the above sentence 
> means something like 
> >> 
> >> IF (the Reply contains a Challenge Extension)
> >> 	 it must be rejected if it does not match the challenge 
> value that 
> >>        had been included in the reg request
> >> ELSE
> >> 	just process as normal reply
> >> END 
> >> 
> >> If that is the case, then I think the sentence should be clarified
> >> to state it in that manner.
> > 
> >I agree that this should be stated clearly.
> >
> >Until Jayashree's email, I too interpreted this sentence as
> >"missing extension or mismatch challenge value in extension," and
> >not as "mismatch challenge value in the (optional) challenge
> >extension."
> >
> >
> >Siva
>

---

From: Yoshiyuki Tsuda <[email-masked]>
Date: Sat, 01 Feb 2003 07:48:49 +0900

Hello Jayshree,

 Thanks a lot for your efforts.

 I agree, an FA should protect against such a bad MN, too.
 I think, this case isn't the only one that a bad MN keeps
 sending registration requests.  But, your qualification
 in order for an FA to keep track of such an MN's behavior
 will be quite valuable.
 Also, for an MN, you know, if there is no security association
 with a contacting FA, and if the FA overwrites the code in a
 registration reply, an MN will almost blindly accept it and
 react based upon the code.  So, protecting an FA will become
 quite important in near future.  Have a great weekend.

Thanks.
-Yoshi