Subject: [mobile-ip] IETF Last Call changes to Registration Revocation

From: "Madhavi W. Chandra" <[email-masked]>
Date: Fri, 23 May 2003 12:14:55 -0400

Hi All,

We submitted version -07 of the 'Registration Revocation for
Mobile IPv4' draft based on IETF Last Call feedback.  The changes from
version -05 are as follows:

Version -05 to -06

- Removed support for batch revocations
      - Removed 'M' bit from the Revocation Extension
      - Removed 'Code/Mask' field from the Revocation Message
      - Removed 'Code/Mask' definitions
      - Removed all references to prefix length extensions

- Added an agent 'Direction' bit in the Revocation Message.  This
  bit distinguishes a revocation sent by a foreign agent from one
  sent by a home agent.  It alleviates the 'false positive' trigger
  on replay protection if a home agent and foreign agent
  coincidentally revoke the same binding within 1/2 of the round
  trip time with the same time-stamp in the ID field.

- Clarified how a foreign agent protects the revocation extension in
  cases where its address does not appear in the mobile IP
  registration request, e.g., the 'D' bit in the registration request
  is set to '1' by a co-located mobile node.  Note that the foreign
  agent's address may not appear as the IP source address of the
  registration request either, e.g., via proxy, or AAAF.

- Removed Appendix on 'Using Registration Revocation to Help
  Release Resources.'

- Removed Appendix on 'Registration Revocation in "R" and "D" Bit
  Worlds.'

- Editorial changes and removal of redundant text.

Version -06 to -07

- Editorial changes.

- Removed support of co-located mobile nodes registering via a
  foreign agent (with the 'R' bit set in the agent advertisements).
  This was shown to have security implications from active
  attacks that are not yet solved, and was thus removed at the last
  stage.  Section 4.3.2 of the draft explains why this case cannot be
  supported today.

</begin excerpt from draft>

 4.3.2  The 'D' bit in Use

   A mobile node registering directly with its home agent in a
   co-located fashion with the 'D' bit set in its registration request
   is supported in registration revocation.  However, support for a
   co-located mobile node (with the 'D' bit set in its registration
   request) registering via a foreign agent is not supported for the
   following reasons.

   Registration requests where the 'D' bit is set, and which are
   relayed through a foreign agent (e.g., due to the advertising of
   the 'R' bit) should theoretically contain the foreign agent address
   as the source address of the registration request when received by
   the home agent.  A home agent may conclude that the source address
   of this registration request is not the same as the co-located
   care-of address contained in the registration request, and is
   therefore likely to be the address of the foreign agent.  However,
   since there is no way to guarantee that this IP source address is
   in fact an address of the foreign agent servicing the mobile node,
   accepting a revocation message from this IP source address may lead
   to a denial-of-service attack by a man-in-the-middle on the mobile
   node.

   Moreover, there is currently no method for the foreign agent
   servicing the mobile node to identify itself to the home agent
   during the Mobile IP registration phase.  Even if a foreign agent
   could identify itself, the co-located mobile node would also need
   to authorize that this foreign agent is indeed the agent that is
   providing it the Mobile IP services.  This is to thwart a
   denial-of-service attack on the mobile node by a foreign agent that
   has a security association with the home agent, and is on the path
   between the co-located mobile node and the home agent.

</end excerpt>

Regards,
Madhavi

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 23 May 2003 20:19:21 +0200

Hi Madhavi,

        Thanks for summarizing the changes done; I was just wondering
about what had changed in the latest version when it was announced a
little while ago.  All the changes you describe makes sense to me. Hope
that it can finally go out now, I understand there's been quite some
time pressure.

	Best regards,
		Henrik

---

From: "Madhavi W. Chandra" <[email-masked]>
Date: Fri, 23 May 2003 14:39:34 -0400

HI Henrik,

> little while ago.  All the changes you describe makes sense to me. Hope

Version -06 was announced about a week or so ago.  The changes from
that version to the version announced yesterday (version -07) are
described below under the heading 'Version -06 to -07'.  The main
change was removal of support for co-located MN registering via an FA.  

> that it can finally go out now, I understand there's been quite some

I hope the draft is on its way too!  The main reason for removing
support for a co-located MN registering via an FA was because there is
currently no way for the FA to identify itself in the RRQ.  And,
because of the time constraints we could not define an FA NAI in
another draft and have a normative reference to that draft.

By the way, thank you for your detailed review of the draft.

Regards,
Madhavi

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 23 May 2003 20:57:09 +0200

On Fri, 23 May 2003 14:39:34 -0400, "Madhavi W. Chandra" <[email-masked]> wrote:
[...]
> change was removal of support for co-located MN registering via an FA.

Yes, I noticed, and understand the reason.

> another draft and have a normative reference to that draft.

Right. That seems like an rather obvious extension to standardize,
though.  Should be done for future use, I suspect.

> By the way, thank you for your detailed review of the draft.

Oh, you're welcome! I'm just sorry it came so late; I missed the
WG last call (probably because it was in the middle of the summer
and I was on vacation) and then I had my hands full the first week
of the IETF last call.

Take care!
		Henrik