Subject: [mobile-ip] mobile authentication inconsistencies, resend

From: [email-masked]
Date: Mon, 5 May 2003 13:44:09 -0500

sorry about that -- missing an OR in the first section...

Hi everyone,

Following the discussions in this thread, regarding authentication
clarifications, I'm trying my hand at suggesting a few modifications.. Let
me know what you think,

ali

--------- RFC3012bis-04, section 3.2, bottom of page 6 ---------

"The Foreign Agent MUST NOT remove the MN-AAA Authentication Extension from
the Registration Request prior to the completion of the authentication
performed by the AAA infrastructure."

replace this sentence with:

"The Foreign Agent MUST NOT remove the MN-AAA Authentication Extension and
the FA-Challenge extension from the Registration Request when forwarding
the message to the Home Agent."

OR, for more local policy flexibility:

"Unless explicitly instructed by the AAA infrastructure to remove the
MN-AAA Authentication Extension and the FA-Challenge extension, the Foreign
Agent MUST NOT remove these extensions from the Registration Request when
forwarding the message to the Home Agent."

--------- RFC3012bis-04, section 6 ---------

Insert section 6.1:

6.1 Co-Located Mobile Node Processing

When the mobile is registering in co-located mode, depending on local
policy, it may randomly choose a challenge value, and compute the MN-AAA
authenticator. A mobile which does so, MUST include the challenge value it
chose in the FA-Challenge extension field and the MN-AAA authenticator it
calculated in the MN-AAA Authentication extension field of the mobile-ip
registration request it generates.

--------- RFC 3344, section 3.7.2.2, 11th line after the header ---------

" - It MUST process and remove any extensions following the Mobile-Home
Authentication Extension".

Replace this sentence with:

" - It MUST remove any extensions following the Mobile-Home Authentication
Extension, unless the specification for that extension explicitly states
otherwise".

---

From: [email-masked]
Date: Tue, 6 May 2003 14:50:08 -0500

Hi Jayshree,

Your wording of the modified sections is great.
One question, though.. in the edit to the change to section 3.2, you have
removed the requirement to retain the FA-challenge in the rreq. The
challenge has to be communicated to the HA in order for the HA to formulate
the AAA access-request.

Basically, the HA uses the challenge value in the chap challenge and the id
fields.

CHAP_Challenge = MD5(PreceedingMIPData) +
LeastOrder237bytesFromChallenge(or lesser if challenge<237)
CHAP_Password  = MN-AAA Auth
CHAP_ID        = HigherOrderByteFromChallenge

The AAA can then use the secret key which is known only to the MN and the
AAA, to re-formulate the MN-AAA authenticator (which is presented in the
CHAP password field of the access-request)..

In other words, without the challenge, the MN-AAA authenticator cannot be
recomputed by the AAA..

So how about:

"The Foreign Agent MUST NOT remove the Mobile-AAA Authentication Extension
and the Mobile-Foreign Challenge extension from the Registration Request."

ali

"Jayshree Bharatia" <[email-masked]>@sunroof.eng.sun.com on
05/06/2003 02:08:14 PM

Sent by:  [email-masked]

To:   Ali Akgun/MW/US/3Com@3Com, [email-masked]
cc:   [email-masked], Tom Hiller <[email-masked]>, "Pat R.
      Calhoun" <[email-masked]>
Subject:  [mobile-ip] RE: mobile authentication inconsistencies, resend

Hi Ali,

Please see my comments inline.

Regards,
Jayshree

> "The Foreign Agent MUST NOT remove the MN-AAA Authentication
> Extension from the Registration Request prior to the
> completion of the authentication performed by the AAA infrastructure."
>
> "The Foreign Agent MUST NOT remove the MN-AAA Authentication
> Extension and the FA-Challenge extension from the
> Registration Request when forwarding the message to the Home Agent."
>
> "Unless explicitly instructed by the AAA infrastructure to
> remove the MN-AAA Authentication Extension and the
> FA-Challenge extension, the Foreign Agent MUST NOT remove
> these extensions from the Registration Request when
[JB] Currently I have added the following text:
"The Foreign Agent MUST NOT remove the Mobile-AAA Authentication Extension
from the Registration Request."

> When the mobile is registering in co-located mode, depending
> on local policy, it may randomly choose a challenge value,
> and compute the MN-AAA authenticator. A mobile which does so,
> MUST include the challenge value it chose in the FA-Challenge
> extension field and the MN-AAA authenticator it calculated in
> the MN-AAA Authentication extension field of the mobile-ip
[JB]I have modified your text as below:

"Based on local policy, a Mobile Node with co-located care-of-address MAY
include the Mobile-AAA Authentication extension in Registration Request.
In this case, the Mobile Node MUST include the Mobile-Foreign Challenge
extension prior to the Mobile-AAA Authentication extension. The mechanism
used by the Mobile Node to obtain the Challenge value is outside the scope
of this document."

I would think that this new text will be best fitted in section 3.1
as a last paragraph).

Please let me know if you have any comments/suggestions.

---

From: "Jayshree Bharatia" <[email-masked]>
Date: Wed, 7 May 2003 16:18:08 -0500

Hi Ali,

I have added the following text:

"If the Mobile-AAA Authentication Extension is present in the Registration
Request, the Foreign Agent MUST NOT remove the Mobile-AAA Authentication
Extension and the Mobile-Foreign Challenge Extension from the Registration
Request."

Let me know if you have further comments/suggestions.

Regards,
Jayshree
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> Sent: Tuesday, May 06, 2003 2:50 PM
> To: Bharatia, Jayshree [RICH1:2H13:EXCH]
> Cc: [email-masked]; [email-masked]; 
> Tom Hiller; Pat R. Calhoun
> Subject: Re: [mobile-ip] RE: mobile authentication 
> inconsistencies, resend
> 
> 
> 
> Hi Jayshree,
> 
> One question, though.. in the edit to the change to section 
> 3.2, you have removed the requirement to retain the 
> FA-challenge in the rreq. The challenge has to be 
> communicated to the HA in order for the HA to formulate the 
> AAA access-request.
> 
> Basically, the HA uses the challenge value in the chap 
> challenge and the id fields.
> 
> The AAA can then use the secret key which is known only to 
> the MN and the AAA, to re-formulate the MN-AAA authenticator 
> (which is presented in the CHAP password field of the 
> access-request)..
> 
> In other words, without the challenge, the MN-AAA 
> authenticator cannot be recomputed by the AAA..
> 
> So how about:
> 
> "The Foreign Agent MUST NOT remove the Mobile-AAA 
> Authentication Extension and the Mobile-Foreign Challenge 
> extension from the Registration Request."
> 
> ali
> 
> 
> 
> 
> 
> "Jayshree Bharatia" 
> <[email-masked]>@sunroof.eng.sun.com on 
> 05/06/2003 02:08:14 PM
> 
> > "The Foreign Agent MUST NOT remove the MN-AAA 
> Authentication Extension 
> > from the Registration Request prior to the completion of the 
> > authentication performed by the AAA infrastructure."
> >
> > "The Foreign Agent MUST NOT remove the MN-AAA 
> Authentication Extension 
> > and the FA-Challenge extension from the Registration Request when 
> remove the 
> > MN-AAA Authentication Extension and the FA-Challenge extension, the 
> > Foreign Agent MUST NOT remove these extensions from the 
> Registration 
> > Request when forwarding the message to the Home Agent."
> >
> "The Foreign Agent MUST NOT remove the Mobile-AAA 
> Authentication Extension from the Registration Request."
> 
> > policy, it may randomly choose a challenge value, and compute the 
> > MN-AAA authenticator. A mobile which does so, MUST include the 
> > challenge value it chose in the FA-Challenge extension 
> field and the 
> > MN-AAA authenticator it calculated in the MN-AAA Authentication 
> > extension field of the mobile-ip registration request it generates.
> >
> "Based on local policy, a Mobile Node with co-located 
> care-of-address MAY include the Mobile-AAA Authentication 
> extension in Registration Request. In this case, the Mobile 
> Node MUST include the Mobile-Foreign Challenge extension 
> prior to the Mobile-AAA Authentication extension. The 
> mechanism used by the Mobile Node to obtain the Challenge 
> value is outside the scope of this document."
> 
> I would think that this new text will be best fitted in 
> section 3.1 as a last paragraph).
>