Re: [Mip4] RFC3012bis: Proposal for Issue2-Change5

[Henrik Levkowetz <henrik@levkowetz.com>]

On Thursday,  4 Sep 2003, Ahmad wrote:

> Hi, Pete,
...
> >  > >  > > 
> >  > >  > > After that, we could add, "To meet the security obligations 
> >  > >  > > outlined in Section 12, the FA SHOULD use one of the already 
> >  > >  > > stored, previously unused challenges when responding to an 
> >  > >  > > unauthenticated Registration Request or Agent Solicitation."
> 
> If we are trying to prevent such DOS attack by NOT INVALIDATING the
> challenge received in RRQ, why not sending that challenge (still valid) back
> in RRP. Is there a problem with that?

I guess there is a rather large conceptual difference in expressing
that a challenge is copied from a received request, and to say that
it is taken from an internally generated, stored value. In the first
case, if this wording is followed by the implementers, it may open
up for buffer overrun attacks, which would be unfortunate.

(There may be other issues with this too, but I'll leave that to Pete)

	Henrik

Attachment: pgp00010.pgp
Description: PGP signature