Re: [Mip4] RFC 3344 - Home Agent Registration Code 132 -foreignagent failed authentication

["Charles E. Perkins" <charles.perkins at earthlink.net>]

Hello Kent,

I think there are several cases, and that each case could
likely have different answers.  The original issue was about
the FA-HA authentication, but I agree with you that the
case of the MN-HA authentication is important.

I think these are the relevant cases, with some
suggested actions for each case.
- FA-HA authentication fails:
    -- FA-HA SA exists ==>  MAY send #132
    -- no FA-HA SA  ==>  MUST silently drop

- MN-HA authentication fails, no FA-HA SA:
    -- MN-HA SA exists ==>  MAY send #131
    -- no MN-HA SA  ==>  MUST silently drop

- MN-HA authentication fails, FA-HA authentication:
    -- MN-HA SA exists ==>  MUST send #131
    -- no MN-HA SA  ==>  MUST silently drop

Here, in the last case when there is no SA with the
mobile node, the foreign agent can soon clean up
its pending registration list.  Since the FA has
proved its identity to the HA, it could eventually
infer by the lack of RREQs from the HA, even
after retries by the MN, that the MN was not
known to the home agent.

Another possibility would be to assign a new error
code for a RREQ that was purely for the purpose of
notifying the FA that the mobile node was unknown.
Then the FA would not forward this RREQ to the
MN, but just expunge its pending registration entry.

What do you think?

Regards,
Charlie P.



Kent Leung (kleung) wrote:
> Hi Ahmad.  Yes, a similar remark was made in this thread already.
> Anyways, just wanted to point out this issue is more applicable to MHAE.
>
> Kent 
>
> -----Original Message-----
> From: Ahmad Muhanna [mailto:amuhanna at nortel.com] 
> Sent: Friday, August 22, 2008 10:13 AM
> To: Kent Leung (kleung); Charles E. Perkins; Mobile IPv4 Mailing List
> Cc: George Tsirtsis; Acee Lindem
> Subject: RE: [Mip4] RFC 3344 - Home Agent Registration Code 132
> -foreignagent failed authentication
>
> Hi Kent,
>
>   
>> Anyways, I'm not sure how my quoted comment was interpreted as a 
>> "MAY"?
>> A response from the HA (when it has a FA-HA security
>> association) to the FA has been userful in deployments.  
>> There isn't likely a DoS from FA.
>>     
>
> [Ahmad]
> Sure, any behaving node will not cause a DoS attack. The problem is from
> an attacker claiming that it is an honest FA. I am not trying to open
> this topic for discussion again, but I am strictly commenting on your
> above statement.
>
> Cheers!
> Ahmad
>
>   
>> I think the more relevant issue is with the MN-HA authentication 
>> rejection.  The current text contains:
>>
>>     

-- 
Mip4 mailing list: Mip4 at ietf.org
    Web interface: https://www.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/