Subject: Re: FW: [mobile-ip] AD question on authorization in draft-ietf-mobileip-reg-revok-04.txt

From: "Steven M. Glass" <[email-masked]>
Date: Fri, 14 Feb 2003 13:28:40 -0500

Sorry about the delayed response, Thomas; I just saw this today!

> -----Original Message-----
> From: ext Thomas Narten [mailto:[email-masked]]
> Sent: 02 January, 2003 02:28 PM
> To: [email-masked]
> Subject: [mobile-ip] AD question on authorization in
> draft-ietf-mobileip-reg-revok-04.txt
>
>
> I have some questions about authorization that I wonder if they have
> been thought through sufficiently, or whether I just don't
> sufficiently understand some underlying assumptions. In particular,
> the question I have concerns how useful some of the more general
> operations allowed by the Revocation Mask actually are.
>
> First, the key part of authorization seems to be:
>
>> Note that the scope of the revocation MUST only apply to the subset of
>> bindings between the revoking agent, and the agent receiving the
>> revocation message. For example, if foreign agent x.y.z.t sends a
>> revocation message to home agent a.b.c.d for mobile node subnet
>> a.b.c.0, and sets the revocation mask to 0x01, the home agent MUST NOT
>> revoke all of its bindings for mobile nodes on the same home link as
>> the revoked mobile node, but only those mobile nodes that are also
>> visiting the foreign agent sending the revocation message.
>
> Is this correct? Seems to me like the *only* operations that should be
> allowed are those that are authorized by a particular security
> association. If I have two MNs, both from the same Home Domain, both
> visiting the same Foreign Domain (and using the same HA and FAs), will
> there be a single Security Association between the HA and FA (covering
> both MNs) or will there be two (i.e., separate ones for the two MNs)?
> I would have assumed there would be two separate ones. If this is the
> case, the scope of what a particular revocation can do is limited to
> the one MN, and many/most of the operations implied by the Revocation
> Mask don't seem to be very useful (because they can't really be
> authorized in general).

     Actually, I don't believe its specified in 3344 or any of its 
predecessors.  The general model, using the authenticator described by 
the core document, uses an SPI to indicate which shared secret was used 
to hash the packet.  While this doesn't preclude there being more than 
one {SPI, KEY} to be used by this purpose, it's not required that a FA 
use a separate {SPI, KEY} for each MN registering with it.  Put another 
way, *any* {SPI, KEY} already exchanged by the domains for use between 
the HA and FA could be used for any MN registration.  There's also no 
mandate that the FA use the same {SPI, KEY} the next time the MN 
reregisters.  Generally, I would expect FA's to round-robin which {SPI, 
KEY} they use, though the method is up to them, or whatever agreement 
may be in place.  Note that almost certainly different MNs use 
different {SPI,KEY} for their registrations with the same HA, but the 
extensibility of this is up to implementors (e.g. some implementors use 
global {SPI,KEY}, others may specify these on a per-MN basis).

     To directly address your concerns, the short answer is the SA 
between HA and FA is used to secure traffic between the two agents, and 
is not generally specific to particular MN bindings.

> What I'm trying to understand is what is safe to be authorized. E.g.,
> if an FA gets a revocation message from an HA, just how does the FA
> know which of the bindings it has are authorized to be released by a
> specific revocation message?  It does not seem sufficient to just say
> (as above) "subset of bindings between the revoking agent and agent
> receiving the revocation message". All revoked bindings must be tied
> together by a shared security relationship.

     The last sentence is implied by the way authenticators work in 
mobile ip (apologies if this is already understood, though it may be 
useful to some on the alias):

     Here's what an in-flight packet looks like between the agents:

     {registration}{mobile-home auth}{foreign-home 
extensions}{foreign-home auth}

     The mobile-home auth allows the HA and MN to detect if any bits in 
the registration have changed in-flight.  The foreign-home auth allows 
the HA and FA to detect if any bits in the registration, mobile-home 
auth, or foreign-home extensions have changed in-flight.

> Does this make sense?

     The explanation you attached from the draft was mainly meant as a 
caveat that if e.g. an HA gets a revocation message with a code stating 
"all bindings with MNs from subnet A" the HA shouldn't blindly delete 
all bindings with MNs on that subnet, but ONLY those that are also 
registered with the revoking FA.  For illustration:

         All MNs belong to x.y.z.0 (24 bits of subnet)

         FA1 Visitors:  {MN1, HA1}
                        {MN3, HA1}
                        {MN4, HA1}
                        {MN8, HA1}

         FA2 Visitors:  {MN2, HA1}
                        {MN5, HA1}

         HA1 Bindings:  {MN1, FA1}
                        {MN2, FA2}
                        {MN3, FA1}
                        {MN4, FA1}
                        {MN5, FA2}
                        {MN8, FA1}

     If FA2 sends a revocation with, {mask=0x01, homeAddr=x.y.z.0, 
foreignDomainAddr = FA2, homeDomainAddr=HA1}{prefixLength=24}, HA1 MUST 
only revoke bindings for MN2, and MN5!  It should be clear, because FA2 
sent the message, and its address appears in the HA's binding table 
associated with only MN2, and MN5.  The text you quoted is provided to 
make that clear, a revocation can only apply to "the subset of bindings 
between the revoking agent, and the agent receiving the revocation 
message."

                                Cheers,
                                    Steve