% File              : template.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{CAM}%
% authors
{Greg O'Shea and Michael Roe}%
% date of the first publication
{04/2001}%
% editor name
{Michael Roe}%
% date of submission
{10/01/2003}%
% date of last change, empty or = date of submission
{28/11/2002}

\begin{abstract}
A protocol used by mobile computers to inform their peers when their
network address has changed.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{M,C}{principal}
\dcl{Tm}{timestamp}
\dcl{PK,SK}{principal -> key (keypair)}
\dcl{HoA}{principal -> address}
\dcl{CoA}{principal -> address}
\dcl{i}{salt}
\end{declarations}

\begin{messages}
\msg{1}{M}{C}{CoA(M), HoA(C), HoA(M), PK(M), i, Tm,}
\msg{}{}{}{\crypt{H(CoA(M), HoA(C), HoA(M), Tm)}{SK(M)}}
\action{HostPart(HoA(M)) = H(PK(M), i)}
\end{messages}
\end{core}

\begin{explanation}
Each mobile node (\code{M}) generates a key pair \code{PK(M), SK(M)}. \code{M} then generates a home
address \code{HoA(M)} by concatenating the routing prefix of its home network with a
hash of \code{PK(M)} and a salt \code{i}. \code{HoA(M)} serves two purposes. It is used by the 
correspondent \code{C} as an identifier for \code{M}, and it is a routable network address
that can be used to contact a home agent that will forward messages on to \code{M}.
The places where \code{M} can be attached to the network are also given identifiers;
\code{CoA(M)} is the identifier of \code{M}'s current network attachment point. 
\code{CoA(M)} varies over time. 
\code{M} knows (by means outside the protocol) when \code{CoA(M)} changes.

\code{M} has a set of correspondents that it wishes to communicate with. The set of \code{M}'s correspondents varies over time.

\code{M} runs the protocol with \code{C} when any of these events happens:

\begin{itemize}
\item
\code{CoA(M)} changes and \code{C} is one of \code{M}'s correspondents
\item
\code{M} adds \code{C} to its set of correspondents
\item
\code{C} is one of \code{M}'s correspondents, and time \code{delta1T} (as measured by \code{M}'s local clock) 
has elapsed since \code{M} last ran the protocol with \code{C}
\end{itemize}

Each correspondent \code{C} maintains a table mapping home addresses
\code{HoA(M)} to care-of addresses \code{CoA(M)}. 
This is a partial table --- there can be home addresses \code{HoA(M)} that do not have an entry in the table.

When \code{C} receives message \code{1}, it will check that the timestamp \code{Tm} is within 
\code{delta2T} of the current time (as measured by \code{C}'s local clock); that the home 
address satisfies the relation \code{HostPart(HoA(M)) = H(PK(M), i)}; and that the
signature can be verified with \code{PK(M)}. 
If all of these checks pass, \code{C} adds the pair to \code{(HoA(M),CoA(M))} to its table, replacing the previous entry for 
\code{HoA(M)} if one exists.

If \code{C} has not accepted a valid message containing \code{HoA(M)}
within the last \code{Delta3T} seconds, 
then it will remove the entry for \code{HoA(M)} from its table.

The local clocks of \code{M} and \code{C} are assumed to be loosely synchronised. 
That is, there exists a \code{Delta4T} such that the times measured by
\code{C} and \code{M}'s clocks 
are within \code{Delta4T} of each other. Clocks are assumed to be monotonically increasing.
\end{explanation}

\begin{property}
There is a time interval \code{DeltaT} such that if \code{CoA(M)} has
not changed within the last \code{DeltaT} seconds, 
and both \code{C} and \code{M} are following the protocol, then either
\code{C}'s table does not contain an entry 
for \code{HoA(M)} or \code{C}'s table contains \code{(HoA(M), CoA(M))}.
\end{property}

\begin{references}
This protocol was described by O'Shea and Roe in Computer Communications
Review \cite{OShea2001}. A concrete realisation of this protocol is given
in the first version of the Internet draft 
\code{draft-roe-mobileip-updateauth-00.txt} (\cite{Roe2002});
later versions of this document describe a different protocol that meets
additional requirements.
The idea of constructing IPv6
addresses from the hash of a public key was proposed by 
Christian Huitema \cite{Huitema98}, Jeff Schiller and others.

Related protocols have been proposed by Bradner, Mankin and Schiller
\cite{Bradner2002}, Montenegro and Castelluccia \cite{Montenegro2002}
and Nikander \cite{Nikander2001,Nikander2003}.
\end{references}

% \begin{proofs}
% \end{proofs}

% \begin{attacks}
% \begin{messages}
% \msg{}{}{}{}
% \end{messages}
% \end{attacks}

\begin{remark}
Authentication of the principal \code{M} is not a goal of this
protocol. 
Although \code{C} cannot necessarily distinguish a run of the protocol with \code{M} from a run of the protocol with a different principal, this is not an attack.

If authentication of \code{M} is desired, the protocol can be used in conjunction with
an additional protocol that authenticates \code{M}.

Runs of the protocol in which \code{M} tries to run the protocol with
\code{C}, but \code{C} does not create a table entry (e.g. because an attacker
prevents the message from reaching \code{C}) are also not attacks. 
It is an assumption of the protocol that the absence of a table entry for
\code{HoA(M)} is ``fail safe'' and does not correspond to an insecure state. 
The table entry is used for an optimisation only; if it is not present, \code{C} has an alternative method of proceeding without it.
\end{remark}

% \begin{see} 
%\crossref{}, see all.aux for labels names
% \end{see}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 

