Mobile IPv4 Challenge/Response Extensions (Revised)
obsoletes
- rfc-3012 — Mobile IPv4 Challenge/Response Extensions
updates
- rfc-3344 — IP Mobility Support for IPv4
Extracted elements (27)
The Generalized Mobile IP Authentication Extension uses a subtype field to allow future authentication algorithms to be added without defining new extension types. Currently only subtype 1 (HMAC-MD5) is defined, but new subtypes can introduce different algorithms if HMAC-MD5 needs to be replaced.
The Mobile-AAA Authentication extension is designed so the foreign agent can interact with AAA infrastructure (e.g., RADIUS servers) to authenticate mobile nodes without requiring a direct security association between the foreign agent and the mobile node, enabling use of existing AAA deployments.
Since the Challenge extension type (24) falls in the range 128-255 for the Mobile-Foreign Challenge extension (132, skippable), a home agent that does not recognize the Challenge extension MUST still process the Registration Request per RFC 3344 and will send a Registration Reply without the Challenge extension.
The Mobile-AAA Authentication extension MAY co-exist in the same Registration Request with Mobile-Home and Mobile-Foreign Authentication extensions defined in RFC 3344, enabling gradual AAA infrastructure adoption without breaking existing authentication mechanisms.
After an error, if the mobile node attempts to register again, it MUST use a new Challenge value obtained either from an Agent Advertisement or from a Challenge extension in the error Registration Reply.
Any Registration Request containing a Challenge extension without either a Mobile-Foreign or Mobile-AAA Authentication extension MUST be silently discarded by the foreign agent.
Each mobile node MUST support the ability to produce the Mobile-AAA authenticator using HMAC-MD5 computed over the preceding Mobile IP data concatenated with the Type, Subtype, Length, and SPI fields.
If a solicited Agent Advertisement is multicast, the foreign agent MUST NOT generate a new Challenge value; it must re-use the most recent of the CHALLENGE_WINDOW advertised Challenge values.
If both Mobile-Foreign Authentication and Mobile-AAA Authentication extensions are present, the Mobile-Foreign Challenge extension MUST precede the Mobile-AAA Authentication extension, and the Mobile-AAA Authentication extension MUST precede the Mobile-Foreign Authentication extension.
If the home agent receives a Registration Request with the Mobile-Foreign Challenge extension and recognizes it, the home agent MUST include the Challenge extension in the Registration Reply, placed after the Mobile-Home authentication extension.
If the Mobile-AAA Authentication extension is present in the Registration Request, the foreign agent MUST NOT remove the Mobile-AAA Authentication extension and the Mobile-Foreign Challenge extension from the Registration Request before forwarding to the home agent.
If the mobile node has no security association with the foreign agent, it MUST include the Mobile-AAA Authentication extension when it includes the Mobile-Foreign Challenge extension, and SHOULD include the NAI extension to enable the foreign agent to use available verification infrastructure.
If the Registration Request does not include a Challenge extension when one is required, the foreign agent MUST send a Registration Reply with Code field set to missing_challenge (105).
In any new Registration Request, a mobile node MUST NOT use any Challenge Value that was advertised before the Challenge Value used in the mobile node's last successful Registration Request.
The foreign agent MUST NOT accept any Challenge in the Registration Request unless it was offered in the last Registration Reply, unicast Agent Advertisement sent to the mobile node, or advertised as one of the last CHALLENGE_WINDOW Challenge values in preceding Agent Advertisements.
The foreign agent SHOULD include a new Mobile-Foreign Challenge extension in any Registration Reply (successful or not). If omitting it, the FA MUST still respond with an agent advertisement containing a previously unused challenge in response to subsequent agent solicitations.
When the Agent Advertisement contains a Challenge extension and the mobile node has no security association with the foreign agent, the mobile node MUST include the Challenge value in a Mobile-Foreign Challenge extension to the Registration Request.
CHAP_SPI (value 2) is a reserved SPI number used to indicate CHAP-style authentication (MD5-based) compatible with RADIUS AAA servers. The authenticator is computed using the high-order challenge octet, key, MD5 of preceding data, and least-order 237 octets of challenge.
The Agent Advertisement Challenge Extension (Type 24) is inserted by the foreign agent into Agent Advertisements to communicate a previously unused challenge value for mobile node authentication. The Challenge field SHOULD be at least 32 bits and the Length SHOULD be at least 4 octets.
The Mobile-AAA Authentication extension is subtype 1 of the Generalized Mobile IP Authentication Extension. It uses HMAC-MD5 over preceding Mobile IP data and extension header fields as the default authenticator computation algorithm.
IANA assignments from RFC 3012 are carried over: Generalized Mobile IP Authentication Extension Type 36, MN-FA Challenge Extension Type 132, error code values (unknown_challenge=104, missing_challenge=105, stale_challenge=106, fa_bad_aaa_auth=108, ha_wrong_challenge=109, ha_bad_aaa_auth=144), and CHAP_SPI=2 in the reserved SPI range 0-255.
If the foreign agent uses a Challenge value fewer than 4 octets, it SHOULD include the Identification field value in its records to detect replays, since the short challenge alone may not provide sufficient uniqueness assurance.
The use of MD5 in the CHAP_SPI/RADIUS-compatible authenticator computation (Section 8) is less secure than HMAC-MD5 and MUST be avoided whenever possible. HMAC-MD5 is the preferred algorithm for the Mobile-AAA Authentication extension.
To prevent denial-of-service attacks where an active attacker sends bogus Registration Requests or Agent Solicitations to exhaust challenges, the foreign agent MUST NOT invalidate previously unused challenges when responding to unauthenticated requests and MUST NOT allocate new storage in response to such messages.
The Challenge Extension has a Type field (1 octet, value 24), a Length field (1 octet, indicating Challenge length in octets, SHOULD be at least 4), and a variable-length Challenge field (SHOULD be at least 32 bits).
The Generalized Mobile IP Authentication Extension (Type 36, not skippable) has a Type (1 octet), Subtype (1 octet), Length (2 octets, MUST be at least 20), SPI (4 octets), and variable-length Authenticator field.
The Mobile-Foreign Challenge Extension (Type 132, skippable) carries a Type field (1 octet), Length field (1 octet), and Challenge field copied verbatim from the received Challenge extension in the Agent Advertisement.