RE: Re: New issue: 3012bis challenges in solicited ag ent advertisements

Hi Henrik,

Please see my comments inline.

Thanks,
Jayshree

...
> > [JB] I am trying to see the difference between the "multicasted
> > response to an agent solicitation" case vs "unsolicited multicasted 
> > agent advertisement". From the above description, it seems 
> you agree
> > that both these cases are handled in similar way. But the proposed
> > text (section 2.1-second paragraph mentioned below) just 
> talks about
> > multicasted response to solicited Agent Advertisement. Why?
> 
> Umm.. no, the proposed text (see below) for section 2.1 has 3
> paragraphs, and the third paragraph talks about the case 
> where the response is unicast back to the solicitor, not 
> multicast. Or did I misunderstand you somehow?
> 
[JB] My question was related to second paragraph (section 2.1) of your
proposed text in which you are proposing that if the solicited agent
advertisement is multicasted, new challenge value must not be generated.
Basically, the intent is to use the challenge sent in an Agent Advertisement
for the Registration procedure. Re-using the challenge will solve only
certain cases and not all.

I can see the potential security problem in this particular case but not
sure on the severity because of the challenge mechanism. Any help on this
security topic will be appreciated.

>...
> > > Proposed text:
> > > 
> > > Add at the end of section 2:
> > > 
> > > 2.1 Handling of Solicited Agent Advertisements.
> > > 
> > >   When a foreign agent generates an Agent Advertisement in 
> > > response to a
> > >   Router Solicitation [4], some additional considerations
> come into
> > >   play.  According to the Mobile IP base specification [7], the
> > >   resulting Agent Advertisement may be either multicast
> or unicast.
> > > 
> > >   If the solicited Agent Advertisement is multicast, it MUST NOT
> > >   generate a new Challenge value and update its window of
> remembered
> > >   advertised Challenges. It must instead re-use the most
> recent of the
> > >   CHALLENGE_WINDOW Advertisement Challenge values.
> > > 
> > >   If the solicited Agent Advertisement is unicast back to the 
> > > soliciting
> > >   mobile node, it MUST be handled in the same manner as
> described for
> > >   Challenges issued in a Registration Reply.  A new
> Challenge value
> > >   MUST be generated and remembered as the most recent
> > > challenge issued 
> > >   to the mobile node.
> > > 
> > > 
> > > In section 3.2, change
> > > 
> > > From:
> > >    The Foreign Agent MUST NOT accept any Challenge in the
> Registration
> > >    Request unless it was offered in last Registration Reply issued
> > >    to the Mobile Node, or else advertised as one of the last
> > >    CHALLENGE_WINDOW (see section 9) Challenge values
> inserted into the
> > >    immediately preceding Agent advertisements.
> > > 
> > > To:
> > >    The Foreign Agent MUST NOT accept any Challenge in the
> Registration
> > >    Request unless it was offered in the last Registration Reply or
> > >    unicast Agent Advertisement sent to the Mobile Node, or else
> > >    advertised as one of the last CHALLENGE_WINDOW (see section 9)
> > >    Challenge values inserted into the immediately preceding Agent
> > >    advertisements.