Subject: RE: [mobile-ip] MIPv4: MN-AAA authenticator and challenges

From: "Jayshree Bharatia" <[email-masked]>
Date: Wed, 7 May 2003 13:47:32 -0500

Hi Bjorn,

I didn't see specific reason of your objection other than the fact that the
MN with co-located CoA won't be using challenge-response protocol.
Appreciate if you can further clarify on: why ID generated by the MN is
better compare to Challenge? 

Thanks,
Jayshree

> -----Original Message-----
> From: Bjorn Andersson [mailto:[email-masked]] 
> Sent: Wednesday, May 07, 2003 2:31 AM
> To: [email-masked]
> Subject: [mobile-ip] MIPv4: MN-AAA authenticator and challenges
> 
> 
> > [JB]I have modified your text as below:
> > 
> > "Based on local policy, a Mobile Node with co-located 
> care-of-address 
> > MAY
> > include the Mobile-AAA Authentication extension in 
> Registration Request. 
> > In this case, the Mobile Node MUST include the 
> Mobile-Foreign Challenge 
> > extension prior to the Mobile-AAA Authentication extension. 
> The mechanism 
> > used by the Mobile Node to obtain the Challenge value is 
> outside the scope 
> > of this document."
> > 
> > I would think that this new text will be best fitted in section 3.1
> > as a last paragraph).
> > 
> > Please let me know if you have any comments/suggestions.
> 
> At least I object to the idea that the MN may choose that 
> challenge value itself. What kind of challenge/response 
> protocol would that be? In the case of how the CHAP 
> authenticator is defined, it may be argued that the ID field 
> in the RR header is the challenge, and that this will be 
> included in the MD5 calculated over the RR message. But then 
> again, the reason why the least-order 237 bytes from the FA 
> challenge was included in the CHAP challenge (even though the 
> FA challenge is included in the RR message as an extension) 
> was that MD5 alone is not secure enough. If this is the case, 
> then the mobile node must not for the same reason be allowed 
> to select this challenge itself.
> 
> I suggest that the MN uses the ID field as the challenge in 
> the same way as the FA challenge, if the FA challange is not 
> available. Although it would be redundant information, the MN 
> could add the ID field in a challenge extension to make 
> everybody happy.
> 
>   Bjorn
> 
> -- 
> Bjorn Andersson <[email-masked]>
> PGP id 5AFC144B
> Mobile +358 40 7723074
>

---

From: Bjorn Andersson <[email-masked]>
Date: Thu, 8 May 2003 00:24:41 +0300

> better compare to Challenge? 

Because the ID field _is_ a challenge by the HA; it can't be
arbitrarily chosen.

  Bjorn