1. A Secure Mobile IP Authentication based on Identification Protocol Authors: Doo Ho Choi, Hyungon Kim and Kyoil Jung Source: International Symposium on Intelligent Signal Processing and Communication Systems 2004 (Proceedings of ISPACS 2004 18-19 Nov. 2004) Page(s):709 - 712 Presenter: Jung-wen Lo( 駱榮問 ) Date: 2005/12/22

2. 2 Introduction Mobile IP MN: Mobile Node HA: Home Agent FA: Foreign Agent  Vulnerable to replay attack => FA authenticates the identity of HA or MN in the registration process Identification Protocol A cryptography protocol which is designed to allow one party to gain assurances that the identity of another is as declared Correspondent node Mobile node

3. 3 Short term (One-time password) Long-term 0. secret key k Identification Protocol using One- way function ProverVerifier AliceBob 0. Secret key k; 正整數 t Public key pk=f t (k) 1. i 2. w i =f i (k) 3. f t-i (w i )?=pk TTP 1. i 2. w i =f i (h(k,N)),N 5. f t-i (w i )?=pk Nonce N 3. N 4. pk=f t (h(k,N))

4. 4 Mobile IP Registration Protocol MNFA HA 0. N HA 1. M 1, K 3. M 2, K 2. M 1, K M 1 ={RRQ, N MN, N HA } Verify N HA, K M 2 ={RRP,N MN,N’ HA } 4. M 2, K M: Message RRQ: MIP Registration Request RRP: MIP Registration Reply K: Mac value of Msg under key K K: shared secret key between MN and HA N: Nonce ※ Problem: *Replay attack - 1 & 3 *Man-in-the-middle attack - FA

5. 5 Mobile IP Authentication Protocol based on Identification Protocol MN FA HA Adv,i 1. M 1,s, K,I i MN 3. M 2,j, K,I j MN I i MN =f i (h(K,N HA )) random 0<s<t M 1 ={RRQ, N MN, N HA } Verify N HA, K 4. M 2,j, K Random 0<i<t Agent Advertisement 0. N HA Validate R FA f t-i (I i MN )?=pk I s FA =f s (h(K FA,N HA )) random 0<j<t, j≠i 2. M 1,s, K,j,I s FA CA pk=f t (h(K,N HA )) N HA f t-s (I s FA )?=pk FA I j MN =f j (h(K,N HA ) M 2 ={RRP,N MN,N’ HA } pk FA =f t (h(K FA,N HA )) f j-i (I i MN )?=I j MN or f i-j (I j MN )?=I i MN Mobile IP Authentication pk=f t (h(K,N’ HA ))

6. 6 MN cannot authenticate FA HA should record nonce Comments MNFA HA 0. N HA, E(N HA ) 1. M 1,s, K,I i MN,E(N HA ) 2. M 1,s, K,j,I s FA, E(N HA ) MN FA CA 1.M 1,s, K,I i MN,N I s =f s (h(K FA,N)) N f t-s (I s )?=I t I t =f t (h(K FA,N))