Subject: [AAA-WG]: [issue] Minor corrections/clarifications to draft-mobileip-08

From: "Bob Kopacz" <[email-masked]>
Date: Thu, 17 Jan 2002 16:18:25 -0500

Issue : Minor corrections/clarifications to draft-mobileip-08
Submitter name: Bob Kopacz
Submitter email address: [email-masked] 
Date first submitted: 01-17-2002 
Reference: 
Document: draft-ietf-aaa-diameter-mobileip-08
Comment type: Editorial 
Priority: 1 
Section: 4.6.1, 6.8
Rationale/Explanation of issue: 

  Minor corrections/clarifications.

Requested change: 

  In section 4.6.1, 2nd line of 1st paragraph, change "algorithm"
  to "algorithm and secret"  What follows is the existing 4.6.1

  >  4.6.1 MIP-MN-AAA-SPI AVP
  >  
  >  The MIP-MN-AAA-SPI AVP (AVP Code 341) is of type Unsigned32 and
  >  indicates the algorithm by which the targeted AAA server (AAAH)
  >  should attempt to validate the Authenticator computed by the mobile
  >  node over the Registration Request data.

  In section 6.8, change the name of the 3rd enumerated value 
  from "SHA-1" to "HMAC-SHA-1".

  What follows is the current 4.6.1:

  >  6.8   MIP-Algorithm-Type AVP
  >  
  >  The MIP-Algorithm-Type AVP (AVP Code 345) is of type Enumerated, and
  >  contains the Algorithm identifier used to generate the associated
  >  Mobile IP authentication extension. The following values are
  >  currently defined:
  >  
  >     1   Prefix+Suffix MD5 [4]
  >     2   HMAC-MD5 [13]
  >     3   SHA-1 [17]

  [The following, taken from "AAA Registration Keys for Mobile IP",
  (draft-ietf-mobileip-aaa-key-09.txt), refers to "HMAC-SHA-1"]

  >  3. Dynamic Security Associations
  >  
  >  Mobility Security Associations between Mobile IP entities
  >  (mobile nodes, home agents, foreign agents) contain both the
  >  necessary cryptographic key information, and a way to identify
  >  the cryptographic algorithm which uses the key to produce the
  >  authentication information typically included in the Mobile Home
  >  Authentication extension or the Mobile Foreign Authentication
  >  extension.  In order for the mobile node to make use of key material
  >  created by the AAA server, the mobile node also has to be able to
  >  select the appropriate cryptographic algorithm that uses the key
  >  to produce the authentication.  The following table contains the
  >  supported algorithm identifiers.
  >  
  >     Algorithm Identifier   Name                Reference
  >     ---------------------  ------------------  ------------
  >     1                      MD5/prefix+suffix   RFC 2002 [11]
  >     2                      HMAC-MD5            RFC 2104 [6]
  >     3                      HMAC-SHA-1          RFC 2104 [6]

---

From: Tony Johansson <[email-masked]>
Date: Sun, 27 Jan 2002 17:27:07 -0800

Hello Bob,

>   to "algorithm and secret"  What follows is the existing 4.6.1

I agree.

>   from "SHA-1" to "HMAC-SHA-1".

Are you sure about this? The latest aaa-key draft I can find is
draft-ietf-mobileip-aaa-key-08.txt, which says

      2                      HMAC MD5            RFC 2104 [6]
      3                      SHA-1               FIPS 180-1 [10]

Regards,

Tony

---

From: Tony Johansson <[email-masked]>
Date: Sun, 27 Jan 2002 18:39:45 -0800

All,

I would like to adopt Issue 264. Thus, allow  the User-Name AVP to appear in
AMA and HAA.

Here is the proposed the changes;

1. Add "[User-Name]" to ABNF in section 2.2 AA-Mobile-Node-Answer and section
2.4 Home-Agent-MIP-Answer.

2. Change User-Name in section 8.1, to

.....

User-Name                     | 1   | 0-1 | 1   | 0-1 |
------------------------------|-----+-----+-----+-----|

Comments/Objections?

Regards,

Tony

---

From: "Bob Kopacz" <[email-masked]>
Date: Mon, 28 Jan 2002 09:33:46 -0500

Hi Tony,

> From: Tony Johansson [[email-masked]]
> Sent: Sunday, January 27, 2002 8:27 PM
> To: Bob Kopacz
> Cc: aaa-wg
> Subject: Issue 267
> 
> Hello Bob,
> 
> Bob Kopacz wrote:
> 

I'm pretty sure.  I have a slightly later draft,
draft-ietf-mobileip-aaa-key-09.txt, dated October 2001, in which the
3rd algorithm has been changed to HMAC-SHA-1.

I got draft-ietf-mobileip-aaa-key-09 from 

    http://people.nokia.net/charliep/txt/mobilekey/mip-key.txt

This was posted by Charles Perkins on the mobile ip mailing list.
However it is no longer at that URL, so I will send you a copy
separate from this email.  The IETF search engine doesn't have key-09.
It also looks like key-08 has expired.

As I understand things, SHA-1 is like MD5 in that it provides an
algorithm to crunch a string of octets into a digest.  Where HMAC
comes in is to provide a means to drag a secret key into the process.

So HMAC-MD5 looks like:

        MD5(Key XOR opad, MD5(Key XOR ipad, text))

and HMAC-SHA-1 looks like:

        SHA-1(Key XOR opad, SHA-1(Key XOR ipad, text))

So if the 3rd algorithm is plain old SHA-1, then someone needs to
define how to combine the key and the text before feeding into
SHA-1.

Take care,
Bob K.