Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: "COMBES Jean-Michel RD-MAPS-ISS" <[email-masked]>
Date: Mon, 24 Oct 2005 18:53:29 +0200

Hi,

IMO, we MUST have a solution permitting: 
o the MSP to assign only the HA he wants to allocate
AND
o the MN to pick a HA in from a HA list if the MSP allows such a thing

For the moment, with these proposals, the MSP has not the possibility to
manage its HA as he wants ...

Regarding the two present solutions:
o DNS-based DHAAD
I don't like this solution because such mechanism gives the location,
for a MSP, of all its HA, which are the MIPv6 point of failure and so
the prioritized targets for "bad guys". You give the stick to be beaten
... :(
o ICMP-based mechanism
Here again, the present mechanism gives all the HA but I think it may be
simply modified to give only one HA if the MSP wants to assign HA.
The main issue is regarding its security ... Maybe Alexandru's proposal
or HAHA proposal would be interesting.

Best regards.

JMC.

France Telecom - R&D Division - MAPS/NSS   
Jean-Michel COMBES, Internet/Intranet Security
E-Mail: [email-masked]
Phone: +33 (0)1 45 29 45 94
Fax: +33 (0)1 45 29 65 19
Mobile: +33 (0)6 07 29 30 16 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Narayanan Vidya-CVN065
> Sent: Monday, October 24, 2005 5:21 PM
> To: Francis Dupont; Petrescu Alexandru-AAP021
> Cc: [email-masked]; Kilian Weniger; James Kempf
> Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt 
> 
> >    
> > => the two questions are:
> >  - should we keep a DHAAD mechanism or HA assignment is the right 
> > thing
> >    to do?
> >  - is the DNS-based DHAAD mechanism better enough to replace the 
> > ICMP-base
> >    one?
> > 
> 
> These are good questions. I believe that a DNS-based 
> mechanism is largely better than an ICMP-based mechansim. For 
> those who wish to secure the operation, at least an option is 
> available. Whether DNSSEC will be widely deployed is a 
> separate question, but at least, it is an option. Also, it 
> moves away from having to configure the home network prefix 
> and removes the limitation of dynamic HA assignment within 
> the same subnet, both of which are big pluses in my mind. 
> 
> Regards,
> Vidya
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6