Subject: RE: [mobile-ip] Comments on 3012bis

From: "Jayshree Bharatia" <[email-masked]>
Date: Thu, 10 Jul 2003 17:21:01 -0500

Hello Pete,

Hopefully we can reach to some resolution soon. Please see my response
inline.

Thanks,
Jayshree

> -----Original Message-----
> From: Pete McCann [mailto:[email-masked]] 
> Sent: Thursday, July 10, 2003 2:39 PM
> To: Bharatia, Jayshree [RICH1:2H13:EXCH]
> Cc: [email-masked]'; [email-masked]'; 
> [email-masked]'
> Subject: RE: [mobile-ip] Comments on 3012bis
> 
> 
> 
> Hi, Jayshree,
> 
> Thanks for the proposed changes, you have addressed most of 
> my concerns.  It looks like we are down to only one point of 
> disagreement
> - see below.
> 
> Jayshree Bharatia writes:
>  > >  > [JB] Based on comments from you and Iris, I like to 
>  > > propose the following  > text for section 1.1: "previously 
>  > > used challenge: Any challenge that has  > been used by the 
>  > > mobile node in a Registration Request message and processed  
>  > > > by the Foreign Agent by generating and relaying a 
>  > > corresponding Registration  > Reply message. The Foreign 
>  > > Agent may not be able to keep records for all  > previously 
>  > > used challenges, but see section 3.2 for minimal 
> requirements."  > > 
>  > > This definition is not consistent with the usage of 
>  > > "previously used" in Section 3.2.  The key sentence is 
> the following:  > > 
>  > >    In all
>  > >    other circumstances, if the Foreign Agent receives a 
> Registration
>  > >    Request with a Challenge extension containing a 
> Challenge value
>  > >    previously used by that mobile node, the Foreign 
> Agent SHOULD send
>  > >    a Registration Reply to the mobile node containing 
> the Code value
>  > >    STALE_CHALLENGE.
>  > > 
>  > > In combination with the previous text, this tells me that a 
>  > > "previously used challenge" is previously used as soon as it 
>  > > is received by the FA.  I believe the definition I offered 
>  > > above is precise and accurate (the one beginning "With 
>  > > respect to a given registration request...").
>  > [JB] I still think that the current definition is correct. 
> If there is any  > issue with the received Registration 
> Request as a part of processing, the FA  > will send 
> rejection with new challenge value. In any case, it won't be  
> > possible to reuse the challenge once it is received by the FA.  
> 
> No, it is possible to reuse the challenge in a retransmitted 
> registration request, as outlined in Section 3.2.  Under my 
> reading of that section a retransmission of a Challenge is 
> still a "previously used" challenge, even though the Reply 
> has not been sent/received.  Note that this is different from 
> a "stale challenge" which is one that has been used in a 
> request, validated by the FA, and for which a Reply was sent 
> to the MN.  I would like to keep this distinction in the 
> definitions.  Otherwise, I think you will need to re-write 
> some of the text in Section 3.2.
> 
[JB] I agree that the differentiation is based on whether the FA has sent
corresponding Registration Reply to the MN or not. If the FA has already
sent the reply, and the MN sends the same challenge in the new Registration
Request, it will be "stale challenge". Otherwise, if it will be just
"previously used challenge". If we have agreement on this, I like to propose
the following:
1. The new (proposed earlier) text will still be valid for the "stale
challenge" terminology.
2. Add new definition called "previously used challenge" with the following
description for section 1.1:
"previously used challenge: Any challenge that has been used by the Mobile
Node in the previous Registration Request"

I notice that you have additional statement saying "and that previous
Registration Request passed all checks prior to forwarding to the HA". I
would rather not specify where exactly the Registration Request may be
getting processed once it is received at the FA. It may be forwarded to AAA
or HA. Also, even if it doesn't passes all checks, it is still considered as
a "previously used challenge".

> -Pete

---

From: Pete McCann <[email-masked]>
Date: Fri, 11 Jul 2003 09:53:07 -0500

Hi, Jayshree,

One point below...

 > a "previously used challenge".

But I think this opens up a denial of service attack, where malicious
nodes can consume challenges on behalf of other nodes on the same
link.  If you don't at least check the MN-AAA or MN-FA authentication
on the Challenge, you should not mark it as "previously used" for that
mobile.  That's why I put the language about passing validity checks
at the FA.  This could be consultation of a AAA interface or
verification of the MN-FA auth extension---I was intentionally vague
about that.

-Pete