Subject: [AAA-WG]: RE: Issue 386: MIP-13 Security Issues

From: Bernard Aboba <[email-masked]>
Date: Fri, 24 Jan 2003 11:55:46 -0800 (PST)

-----Original Message-----
From: Tony Johansson
Sent: Sunday, January 19, 2003 5:13 PM
To: [email-masked]; [email-masked]'
Subject: RE: Issue 386: MIP-13 Security Issues

Steve, All,

Se comments embedded below.

Thanks,

/Tony

>Issue 386: MIP-13 Security Issues
>Submitter name: Steve Bellovin
>Submitter email address: [email-masked]
>Date first submitted: November 11, 2002
>Reference:
>Document: MIP-13
>Comment type: T
>Priority: S
>Section: Various
>Rationale/Explanation of issue:
>1.6: What is a "preconfigured shared security association"? Do you
>mean a preshared secret? A security association comprises far more
>than just a key.
[Tony]: In RFC3220 they use security association, which they mean a
shared secret. So, what should I say preconfigured shared secret?

>I have not evaluated the security of the scheme in this section, since
>it depends on another draft, and possibly on the security of MobileIP
>itself. Can we really even consider this draft until those are done?

>1.10: What firewall rules? Are the agents supposed to tell their local
>firewalls to open up some holes?
[Tony]: Per discussion from the review meeting last week - how about the
following text:
.in 0
1.10  IP filter rule support

.in 3
This application has support for pushing filter rules to either of the
mobility agents to enable appropriate restrictions for the mobile node,
such as limiting the mobile nodes access due to roaming agreements or
network protection. The filter rules are set by the AAAH by adding one
or more MIP-Filter-Rule AVPs in the HAR if destined for the home agent
and/or in the AMA if destined for the foreign agent. The filer rules
does only apply to the mobile node in the HAR and/or AMA message, thus
the mobility agents will process the filter rules individually for each
mobile node.

If MIP-Filter-Rule AVPs are included in the HAR and the home agent does
not have support to handle filter rules, the home agent MUST return a
HAA with Result-Code AVP equal to
DIAMETER_ERROR_MIP_FILTER_NOT_SUPPORTED.

If the MIP-Filter-Rule AVPs are included in the AMA and the foreign
agent does not have support to handle filter rules, the foreign agent
SHOULD log the event and MUST issue a Session-Termination-Request (STR)
back to its local Diameter server.

>5.2: 64 bits is not sufficient for a key. Why not just mandate 128,
>instead of strongly recommending it?
[Tony]: This was due to the Mobile IP AAA key distribution draft, which
we are dependent on, however draft-draft-ietf-mobileip-aaa-key-10.txt
has now changed to mandate 128 bit. So, 128 bit is now mandated.

>5: I confess that it still isn't clear to me how the home and foreign
>agents know authoritatively who each other are. Then again, that's
>always been my main complaint about AAA. But here they're handing out
>keys.
[Tony]: Reading through the Diameter MIPv4 application draft again, I
not sure what is missing to make it more understandable. I really need
some help here.