Subject: RE: CoA and AAA (was Re: [Mip6] General comments/questions on MIPv6bootstrapping)

From: "Narayanan Vidya-CVN065" <[email-masked]>
Date: Thu, 27 Oct 2005 10:41:45 -0400

>  In your previous mail you wrote:
> 
>    Actually, I have been following the thread and am still 
> confused as to
>    why CoA verification is needed for bootstrapping. 
>    
> => it is not needed (at the exception of a special case I 
> don't want to support officially). It is just a nice property.
> 

What are you gaining from this for bootstrapping? In other words, what
is it that you lose by assigning a HA or HoA or creating an MN-HA SA
without doing CoA verification? 

I think the main confusion here is that given that CoA is a transient
parameter that keeps changing, while the bootstrapped parameters are
expected not to change often (may be fair to say, as long as the MN
remains powered up, but that may be debatable), what can be the possible
gain of verifying the very first CoA of the MN alone? 

Or, maybe I completely misunderstood your point :) 

Regards,
Vidya

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Thu, 27 Oct 2005 18:04:18 +0200

> don't want to support officially). It is just a nice property.
   
   What are you gaining from this for bootstrapping?

=> better security (a fake CoA doesn't work).

   In other words, what is it that you lose by assigning a HA or HoA
   or creating an MN-HA SA without doing CoA verification?
   
=> nothing.

=> I've already answered about the "alone".

=> or you've missed some messages.

Regards

[email-masked]

---

From: Jari Arkko <[email-masked]>
Date: Fri, 28 Oct 2005 14:38:22 +0300

I have now read some more messages - not sure
if I read all of them.

But I still don't understand why this would be
useful. It seems clear that we could only do it
for the first care-of address, because it makes
no sense to put bootstrapping in the critical
path.

Perhaps we just attempt to provide additional
security (and I agree that in the integrated
scenario we know we have AAA between home
agent and access network). The question, though,
is why. It seems that if we need additional
security, then on subsequent movements we'd
have to do something different.

Or perhaps we attempt to design something
that works with IKEv1 main mode and shared
secrets. Not sure if I have seen all the details,
because recognition of a peer is not about
coa-verification as much as it is about having
an index from addresses to shared secrets.
Also, if vendors have not implemented
IKEv2, what makes us think that if we specify
a new solution that they will implement that
new solution either?

--Jari

---

From: Francis Dupont <[email-masked]>
Date: Fri, 28 Oct 2005 18:13:26 +0200

useful.

=> at least nobody argues it is necessary.

   It seems clear that we could only do it
   for the first care-of address, because it makes
   no sense to put bootstrapping in the critical
   path.
   
=> this is not fully true: if the mobile stays in the same
AAA domain, i.e., if the integrated scenario still applies,
new CoAs can be authenticated.

   security

=> this is the main reason.

   (and I agree that in the integrated
   scenario we know we have AAA between home
   agent and access network).

=> the integrated scenario == applicable context.

   The question, though,
   
=> as I've just explained, when the integrated scenario
still applies we still have the additional security
on subsequent movements.

   secrets.

=> this is a second reason. IMHO it is a good one
but IKEv1 is not considered in bootstrapping scenarios
because IKEv2 is far better. So I explicitely don't
want to use publicly this argument.

   Not sure if I have seen all the details,
   because recognition of a peer is not about
   coa-verification as much as it is about having
   an index from addresses to shared secrets.

=> pre-shared key authentication is based on the fact
the right index is used to get the key.

=> if you argue we should simply implement and use IKEv2
I can't say something else (:-)!

Regards

PS: if we speak in terms of requiments, clearly it is not a MUST,
it can be a MAY and for a SHOULD this is in the hands of operators,
i.e., do they care or not. Operators I know seem to have no clear
opinion about this.