Subject: RE: FW: [mobile-ip] AD question on authorization in draft-ietf-mobileip-reg-revok-04.txt

From: [email-masked]
Date: Fri, 14 Feb 2003 14:03:22 -0600

> 
> Even if there are two or n-zillion SA's,
> authorization checks must still be
> performed. Beware the conflation of auth and
> authz! In general, I don't see that there's a huge
> problem with only having only one SA between the
> HA and FA... Each side, however, needs to keep
> track of which bindings may be manipulated by
> which FA/HA.

In the revised draft (05), the mobility agents are aware
whether the revoking agent supports the ability to have
multiple revocations done with a single message i.e the
support for various masks by either of the agents is known
up front. 

-BPa

> 
> 	Mike
> 
> Steven M. Glass writes:
>  >      Sorry about the delayed response, Thomas; I just saw 
> this today!
>  > 
>  > 
>  > > -----Original Message-----
>  > > From: ext Thomas Narten [mailto:[email-masked]]
>  > > Sent: 02 January, 2003 02:28 PM
>  > > To: [email-masked]
>  > > Subject: [mobile-ip] AD question on authorization in
>  > > draft-ietf-mobileip-reg-revok-04.txt
>  > >
>  > >
>  > > I have some questions about authorization that I wonder 
> if they have
>  > > been thought through sufficiently, or whether I just don't
>  > > sufficiently understand some underlying assumptions. In 
> particular,
>  > > the question I have concerns how useful some of the more general
>  > > operations allowed by the Revocation Mask actually are.
>  > >
>  > > First, the key part of authorization seems to be:
>  > >
>  > >> Note that the scope of the revocation MUST only apply 
> to the subset of
>  > >> bindings between the revoking agent, and the agent receiving the
>  > >> revocation message. For example, if foreign agent 
> x.y.z.t sends a
>  > >> revocation message to home agent a.b.c.d for mobile node subnet
>  > >> a.b.c.0, and sets the revocation mask to 0x01, the home 
> agent MUST NOT
>  > >> revoke all of its bindings for mobile nodes on the same 
> home link as
>  > >> the revoked mobile node, but only those mobile nodes 
> that are also
>  > >> visiting the foreign agent sending the revocation message.
>  > >
>  > > Is this correct? Seems to me like the *only* operations 
> that should be
>  > > allowed are those that are authorized by a particular security
>  > > association. If I have two MNs, both from the same Home 
> Domain, both
>  > > visiting the same Foreign Domain (and using the same HA 
> and FAs), will
>  > > there be a single Security Association between the HA 
> and FA (covering
>  > > both MNs) or will there be two (i.e., separate ones for 
> the two MNs)?
>  > > I would have assumed there would be two separate ones. 
> If this is the
>  > > case, the scope of what a particular revocation can do 
> is limited to
>  > > the one MN, and many/most of the operations implied by 
> the Revocation
>  > > Mask don't seem to be very useful (because they can't really be
>  > > authorized in general).
>  > 
>  >      Actually, I don't believe its specified in 3344 or any of its 
>  > predecessors.  The general model, using the authenticator 
> described by 
>  > the core document, uses an SPI to indicate which shared 
> secret was used 
>  > to hash the packet.  While this doesn't preclude there 
> being more than 
>  > one {SPI, KEY} to be used by this purpose, it's not 
> required that a FA 
>  > use a separate {SPI, KEY} for each MN registering with it. 
>  Put another 
>  > way, *any* {SPI, KEY} already exchanged by the domains for 
> use between 
>  > the HA and FA could be used for any MN registration.  
> There's also no 
>  > mandate that the FA use the same {SPI, KEY} the next time the MN 
>  > reregisters.  Generally, I would expect FA's to 
> round-robin which {SPI, 
>  > KEY} they use, though the method is up to them, or 
> whatever agreement 
>  > may be in place.  Note that almost certainly different MNs use 
>  > different {SPI,KEY} for their registrations with the same 
> HA, but the 
>  > extensibility of this is up to implementors (e.g. some 
> implementors use 
>  > global {SPI,KEY}, others may specify these on a per-MN basis).
>  > 
>  >      To directly address your concerns, the short answer is the SA 
>  > between HA and FA is used to secure traffic between the 
> two agents, and 
>  > is not generally specific to particular MN bindings.
>  > 
>  > > What I'm trying to understand is what is safe to be 
> authorized. E.g.,
>  > > if an FA gets a revocation message from an HA, just how 
> does the FA
>  > > know which of the bindings it has are authorized to be 
> released by a
>  > > specific revocation message?  It does not seem 
> sufficient to just say
>  > > (as above) "subset of bindings between the revoking 
> agent and agent
>  > > receiving the revocation message". All revoked bindings 
> must be tied
>  > > together by a shared security relationship.
>  > 
>  >      The last sentence is implied by the way 
> authenticators work in 
>  > mobile ip (apologies if this is already understood, though 
> it may be 
>  > useful to some on the alias):
>  > 
>  >      Here's what an in-flight packet looks like between the agents:
>  > 
>  >      {registration}{mobile-home auth}{foreign-home 
>  > extensions}{foreign-home auth}
>  > 
>  >      The mobile-home auth allows the HA and MN to detect 
> if any bits in 
>  > the registration have changed in-flight.  The foreign-home 
> auth allows 
>  > the HA and FA to detect if any bits in the registration, 
> mobile-home 
>  > auth, or foreign-home extensions have changed in-flight.
>  > 
>  > 
>  > > Does this make sense?
>  > 
>  >      The explanation you attached from the draft was 
> mainly meant as a 
>  > caveat that if e.g. an HA gets a revocation message with a 
> code stating 
>  > "all bindings with MNs from subnet A" the HA shouldn't 
> blindly delete 
>  > all bindings with MNs on that subnet, but ONLY those that are also 
>  > registered with the revoking FA.  For illustration:
>  > 
>  >          All MNs belong to x.y.z.0 (24 bits of subnet)
>  > 
>  >          FA1 Visitors:  {MN1, HA1}
>  >                         {MN3, HA1}
>  >                         {MN4, HA1}
>  >                         {MN8, HA1}
>  > 
>  >          FA2 Visitors:  {MN2, HA1}
>  >                         {MN5, HA1}
>  > 
>  >          HA1 Bindings:  {MN1, FA1}
>  >                         {MN2, FA2}
>  >                         {MN3, FA1}
>  >                         {MN4, FA1}
>  >                         {MN5, FA2}
>  >                         {MN8, FA1}
>  > 
>  >      If FA2 sends a revocation with, {mask=0x01, homeAddr=x.y.z.0, 
>  > foreignDomainAddr = FA2, 
> homeDomainAddr=HA1}{prefixLength=24}, HA1 MUST 
>  > only revoke bindings for MN2, and MN5!  It should be 
> clear, because FA2 
>  > sent the message, and its address appears in the HA's 
> binding table 
>  > associated with only MN2, and MN5.  The text you quoted is 
> provided to 
>  > make that clear, a revocation can only apply to "the 
> subset of bindings 
>  > between the revoking agent, and the agent receiving the revocation 
>  > message."
>  > 
>  >                                 Cheers,
>  >                                     Steve
>  > 
>

---

From: Michael Thomas <[email-masked]>
Date: Fri, 14 Feb 2003 12:07:47 -0800 (PST)

> support for various masks by either of the agents is known

   The issue really has nothing to do with multiple
   revocations. For each revocation request -- whether in
   a single packet or across many -- the identity of
   requestor must be checked against who is authorized
   to modify the binding. Normally, that would be the
   destination HA/FA. We can't have a situation where
   a rogue HA/FA is allowed to modify bindings of an
   unrelated HA/FA, and that purely a question of 
   authorization.

	Mike

---

From: "Madhavi W. Chandra" <[email-masked]>
Date: Fri, 14 Feb 2003 15:23:25 -0500

Correct.  Only FA1 can revoke bindings between FA1/HA...meaning, even
though FA2 shares a SA with HA, FA2 cannot revoke those bindings.

-Madhavi