Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: Gerardo Giaretta <[email-masked]>
Date: Mon, 24 Oct 2005 19:11:21 +0200

Hi Jean-Michel, 

> Hi,
> 
> IMO, we MUST have a solution permitting: 
> o the MSP to assign only the HA he wants to allocate
> AND
> o the MN to pick a HA in from a HA list if the MSP allows such a thing
> 

I think this is possible using DNS-based scheme defined in
draft-ietf-mip6-bootstrapping-split-01.
If in your opinion exposing HA addresses in DNS is an issue, in
integrated scenario a DHCP-based solution may be used (see the
integarted scenario draft). 

> For the moment, with these proposals, the MSP has not the 
> possibility to
> manage its HA as he wants ...
> 

Why in DNS-based solution you think this is not possible? 

> Regarding the two present solutions:
> o DNS-based DHAAD
> I don't like this solution because such mechanism gives the location,
> for a MSP, of all its HA, which are the MIPv6 point of failure and so
> the prioritized targets for "bad guys". You give the stick to 
> be beaten
> ... :(

Sorry are you referring to DNS-based HA discovery defined in
draft-ietf-mip6-bootstrapping-split-01 or something else? I'm getting
confused with the acronym DHAAD since it is usually used to refer the
solution defined in rfc3775.

--Gerardo

> o ICMP-based mechanism
> Here again, the present mechanism gives all the HA but I 
> think it may be
> simply modified to give only one HA if the MSP wants to assign HA.
> The main issue is regarding its security ... Maybe 
> Alexandru's proposal
> or HAHA proposal would be interesting.
> 
> Best regards.
> 
> JMC.
> 
> France Telecom - R&D Division - MAPS/NSS   
> Jean-Michel COMBES, Internet/Intranet Security
> E-Mail: [email-masked]
> Phone: +33 (0)1 45 29 45 94
> Fax: +33 (0)1 45 29 65 19
> Mobile: +33 (0)6 07 29 30 16 
>  
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]] On 
> > Behalf Of Narayanan Vidya-CVN065
> > Sent: Monday, October 24, 2005 5:21 PM
> > To: Francis Dupont; Petrescu Alexandru-AAP021
> > Cc: [email-masked]; Kilian Weniger; James Kempf
> > Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt 
> > 
> > >    
> > > => the two questions are:
> > >  - should we keep a DHAAD mechanism or HA assignment is the right 
> > > thing
> > >    to do?
> > >  - is the DNS-based DHAAD mechanism better enough to replace the 
> > > ICMP-base
> > >    one?
> > > 
> > 
> > These are good questions. I believe that a DNS-based 
> > mechanism is largely better than an ICMP-based mechansim. For 
> > those who wish to secure the operation, at least an option is 
> > available. Whether DNSSEC will be widely deployed is a 
> > separate question, but at least, it is an option. Also, it 
> > moves away from having to configure the home network prefix 
> > and removes the limitation of dynamic HA assignment within 
> > the same subnet, both of which are big pluses in my mind. 
> > 
> > Regards,
> > Vidya
> > 
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
> > 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6